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ABSTRACT 


Under what circumstances is Russia successful in waging hybrid operations, short 
of the use of armed force? For the last two decades, Russia has undertaken structured 
cyber attacks, political destabilization, subversive activities, and psychological influence 
throughout the world as part of what has become known as “hybrid warfare” or “New- 


Type War’ (NTW). 


This thesis examines two contemporary European case studies—Estonia and 
Montenegro—where Russia has used indirect means such as proxy forces, organized 
crime, and other tools to conduct influence operations in its attempts to achieve its 
foreign policy goals. The thesis investigates how Russia has used, or tried to use, these 
non-state actors; how effective these operations have been; and whether Russia was 


successful in reaching its foreign-policy objectives in target states. 


The thesis finds that Russian NTW campaigns require that there be no cohesive 
society in the target country. Contradictions and a divided society in the target country 
are the basis on which Russia can build an NTW campaign and choose the elements of 
NTW—non-state actors—to carry out the campaign. Thus, the most crucial aspect of 
launching and conducting an NTW campaign is the psychological influencing and so- 


called unbalancing of the target country’s society and government. 
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I. INTRODUCTION 


A. MAJOR RESEARCH QUESTION 


Under what circumstances is Russia successful in waging hybrid operations short 
of the use of armed force? For the last two decades, Russia has undertaken structured cyber- 
attacks, political destabilization, subversive activities, and psychological influence 
throughout the world as part of what has become known as “hybrid warfare” or “New- 
Type War” (NTW). At the same time, Russia has sponsored the involvement and training 
of paramilitary units and organized crime in operations abroad. The initial covert use of its 
specialized military units and special services brought rapid and decisive progress to the 
Russian Federation in annexing Crimea and destabilizing eastern Ukraine. Today, the 
Russian Federation remains active in spreading its influence in Europe, Eurasia, and 


Middle East. 


This thesis examines two contemporary European case studies where Russia has 
used indirect means such as proxy forces, organized crime, and other tools to conduct 
influence operations in its attempts to achieve its foreign policy goals. I investigate how 
Russia has used or tried to use these non-state actors, how effective these operations have 
been, and whether Russia was successful in reaching its foreign policy objectives in target 
states. The central proposition evaluated is whether the effectiveness of Russian use of non- 
state actors is dependent on the target state’s close geographic and/or cultural proximity to 


Russia. 


B. SIGNIFICANCE OF THE RESEARCH QUESTION 


In the first half of 2014, the Russian Federation annexed the Crimean Peninsula in 
a decisive, coordinated manner using various asymmetric military techniques. Despite the 


opposition and condemnation of the Western world, Russia skillfully combined the various 


hybrid warfare elements to meet its strategic, operational, and tactical goals.! The Russian 
Federation incorporated Crimea virtually without a single shot, and approximately 20,000 
active Ukrainian soldiers on the peninsula showed only symbolic resistance.2 Russia 
completed its operations and goals so quickly that the Western world and its leaders were 


left only to react in surprise and admit to the fait accompli.3 


Compared to traditional conventional warfare, the twenty-first century’s military 
conflict features have changed decisively, and to fulfill their goals, states use different, 
seemingly unconnected elements in time and space simultaneously.* Yet, irregular means 
have been used in warfare in cooperation with conventional forces for centuries, and thus, 
the means and aims of so-called hybrid war are not entirely new.> What is new, or rather 
different, is that today’s globalization, technology, and interdependence create a wholly 
changed and increasingly dynamic environment compared to the previous times. Today’ s 
NTW is different because of the diversity, dominance, and impact of irregular assets in that 


changed environment.’ 





! Erik Mannik, “Sdjalise Kriisi Anatoomiast Ukrainas” [Anatomy of the Military Crisis in Ukraine], 
Diplomaatia [Diplomacy], June 20, 2014, https://diplomaatia.ee/sojalise-kriisi-anatoomiast-ukrainas/; Janis 
Bérzins, Russia’s New Generation Warfare in Ukraine: Implications for Latvian Defense Policy, Policy 
Paper no. 2 (Riga, Latvia: National Defence Academy of Latvia Center for Security and Strategic Research, 
2014): 3-7, https://sldinfo.com/wp-content/uploads/2014/05/New-Generation-Warfare. pdf. 


2 Minnik, “Anatomy of the Military Crisis in Ukraine”; Bérzins, Russia’s New Generation Warfare in 
Ukraine, 3-7. 


3 Martin Hurt, “Krimmi Siindmuste Oppetunnid: Kas Eesti Riigikaitsemudel Vastab Taielikult Meie 
Vajadustele?” [Lessons from the Events in Crimea: Does the Estonian National Defense Model Fully Meet 
Our Needs?], Diplomaatia [Diplomacy], May 17, 2014, https://diplomaatia.ee/krimmi-sundmuste- 
oppetunnid-kas-eesti-riigikaitsemudel-vastab-taielikult-meie-vajadustele/. 


4 Andreas Krieg and Jean-Marc Rickli, “Surrogate Warfare: The Art of War in the 21“ Century?” 
Defence Studies 18, no. 2 (2018): 113-114, https://doi.org/10.1080/14702436.2018.1429218. 


5 Alexander Lanoszka, “Russian Hybrid Warfare and Extended Deterrence in Eastern Europe,” 
International Affairs 92, no. 1 (January 2016): 177-178, https://doi-org.libproxy.nps.edu/10.1111/1468- 
2346.12509 


6 Frank G. Hoffman, “Examining Complex Forms of Conflict: Gray Zone and Hybrid Challenges,” 
Prism: A Journal of the Center for Complex Operations 7, no. 4 (November 2018): 36-38, 40-41, 
ProQuest. 


a Margarete Klein, “Russia’s New Military Doctrine - NATO, the United States and the ‘Colour 
Revolutions,’” SWP (Stiftung Wissenschaft und Politik) Comment 2015/C 09 (February 2015): 2, 
https://www.swp-berlin.org/en/publication/russias-new-military-doctrine/; Andrew S. Bowen, Russian 
Armed Forces: Military Doctrine and Strategy, CRS Report No. IF11625 (Washington, DC: Congressional 
Research Service, 2020), https://crsreports.congress. gov/product/pdf/IF/IF 11625. 
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Russian General Valery Gerasimov, the Chief of the General Staff of the Armed 
Forces of Russia, called it new generation warfare in his, later much-cited and widely 
debated, 2013 article.8 General Gerasimov announced that wars are not declared anymore 
and the rules of war are changed, requiring the “integrated use of military force and of 
political, informational, and other non-military measures.’”? Russia’s actions in Ukraine 
have been following these views rather closely.!9 Russia appears set on honing its capacity 
to dismantle a target country’s resistance with unconventional techniques so that 
eventually, the Kremlin would not need to use conventional military means to fulfill its 


foreign policy objectives. 


The success of the Crimean operation raises the question of whether it was a unique 
case. Specifically, did Crimea present extremely favorable conditions that Russia could use 
effectively, such that similar success is unlikely in other cases?!! Or, can Russia create 
similar conditions elsewhere to fulfill its plan? The purpose of this thesis is to evaluate the 
factors contributing to and impeding Russian effectiveness in waging hybrid warfare under 


differing conditions. 


The main proposition of this thesis is that Russia uses violent and non-violent 
non-state actors as proxies that are central elements in the execution of its hybrid strategy. 
It does so to exploit pre-existing vulnerabilities or to create the conditions necessary in the 
target state to make it vulnerable, either rendering it more susceptible to Russian influence 
or preparing the ground for further Russian activities and hostilities. The analysis seeks to 
determine whether the use of non-state actors is working to Russia’s advantage or not, and 
under what circumstances it is working or not working. The factors proposed to determine 
the relative effectiveness of Russian hybrid operations are firstly, the target state’s 
geographic, historical, and cultural proximity to Russia. The second factor is whether 


Russian conventional military assets are used in the target state. 





8 Bowen, Russian Armed Forces: Military Doctrine and Strategy. 
9 Klein, “Russia’s New Military Doctrine - NATO, the United States and the ‘Colour Revolutions,’” 3. 
10 Klein, 3; Bowen. 


11] Bettina Renz, “Russia and ‘Hybrid Warfare,’ Contemporary Politics 22, no. 3 (2016): 284, 
http://dx.doi.org/10.1080/13569775.2016.1201316. 


Cc, LITERATURE REVIEW 


A heated debate exists over the nature and logic of hybrid warfare. Many authors 
are convinced that there is nothing new or groundbreaking about it because many states 
have used indirect means and unconventional tactics throughout the history of war. 
Alexander Lanoszka brings the example that—if one takes into consideration well- 
published elements of Russian hybrid activities towards other states such as propaganda, 
proxies, or sabotage acts—then even the Second World War could be considered a hybrid 
war.!2 The United States Department of Defense definition of unconventional warfare 
aligns with this view: “activities conducted to enable a resistance movement or insurgency 
to coerce, disrupt, or overthrow a government or occupying power by operating through or 
with an underground, auxiliary, and guerrilla force in a denied area.” 13 Historically, 
different actors have developed variations of their style, but in general unconventional 
warfare consists of five core elements: espionage by special services; political warfare that 
includes propaganda, deception, and subversion; sabotage and economic warfare by 
internal networks; guerrilla warfare by irregular forces; and direct action by specialized 


units.!4 


Another group of authors and scholars admits that irregular means have been used 
in wars, conflicts, and campaigns throughout the history, but argue that contemporary 
hybrid warfare has some elements or tactics that differ from previous times and actually do 
make a difference. With its interconnectedness and technologies like the Internet, the 
modern world has helped to modify the tactics and broaden the possibilities for states to 


blur the lines between peace and conflicts. But these authors are either cautious about or 





12 Lanoszka, “Russian Hybrid Warfare and Extended Deterrence in Eastern Europe,” 178. 


13 United States Joint Chiefs of Staff, Department of Defense Dictionary of Military and Associated 
Terms, JP 1-02 (Washington, DC: Joint Chiefs of Staff, 2016): 249, https://apps.dtic.mil/dtic/tr/fulltext/u2/ 
1004650.pdf. 


14 David Kilcullen, “The Evolution of Unconventional Warfare,” Scandinavian Journal of Military 
Studies 2, no. 1 (2019): 62, https://doi.org/10.31374/sjms.35 


4 


opposed to identifying hybrid warfare as a novel Russian invention of warfare.!5 On the 
contrary, Russia’s particular combination of different methods in warfare is the realization 


of practices and experiences tested over time. !6 


On the other hand, those who espouse the novelty of the hybrid warfare concept 
argue that the quick and decisive activities Russia demonstrated in annexing Crimea 
suggest that Moscow has developed an up-to-date approach of hybrid means in armed 
conflict that would give the Russian Federation a clear advantage against neighboring 
states and the West in possible future conflicts.!7 The combination of contemporary hybrid 
threats, a variety of lethal and non-lethal elements—the results of globalization, the 
dissemination of military technologies, and the information revolution—are qualitatively 
distinct from less complicated dangers posed only from unconventional or paramilitary 
troops.!8 The variety of these indirect options helps the aggressor to avert the political 
consequences of warfare and minimize the economic and human strain of war.!9 In general, 
these options cannot be eliminated solely by Western counterterrorism tactics or long-term 


counterinsurgency methods.29 


It is essential to point out that from the Russian point of view, the fighting or mode 


of warfare they are practicing and implementing is not hybrid warfare, but “new-type” 


1S Andrew Monaghan, “The ‘War’ in Russia’s ‘Hybrid Warfare,’” Parameters 45, no. 4 (2015-16): 
65-74, ProQuest; Ofer Fridman, “Hybrid Warfare or Gibridnaya Voyna?” The RUSI Journal 162, no. 1 
(2017): 46, https://doi-org.libproxy.nps.edu/10.1080/03071847.2016.1253370; Mark Galeotti, “Hybrid, 
Ambiguous, and Non-Linear? How New Is Russia’s ‘New Way of War’?” Small Wars & Insurgencies 27, 
no. 2 (2016): 282-301, https://doi-org.libproxy.nps.edu/10.1080/09592318.2015.1129170; Mark Galeotti, 
“(Mis)Understanding Russia’s Two Hybrid Wars,” Eurozine, last modified November 29, 2018: 6-8, 
https://www.eurozine.com/misunderstanding-russias-two-hybrid-wars/?pdf. 


16 Hoffman, “Examining Complex Forms of Conflict: Gray Zone and Hybrid Challenges,” 39. 


17 Hurt, “ Lessons from the Events in Crimea: Does the Estonian National Defense Model Fully Meet 
Our Needs?”; Renz, “Russia and ‘Hybrid Warfare,’” 284; Soma Rusnakova, “Russian New Art of Hybrid 
Warfare in Ukraine,” Slovak Journal of Political Sciences 17, no. 3-4 (2017): 370, DOI: 10.1515/sjps- 
2017-0014. 


18 Hoffman, 38. 
19 Krieg and Rickli, “Surrogate Warfare: The Art of War in the 21‘ Century?” 127. 
20 Hoffman, 38. 


warfare (NTW).2! Charles K. Bartles says that the term hybrid warfare is the West’s 
invention, one that was attributed to the concept of new era warfare that General Gerasimov 
discussed in his 2013 article.22 Bartles emphasizes that “there is a general consensus in 
Russian military circles that hybrid war is a completely Western concept as no Russian 
military officer or strategist has discussed it, except to mention the West’s use of the term, 
or to mention the West’s use of hybrid warfare against Russia.”23 In describing and 


analyzing Russia’s activities, the author uses the term NTW in this thesis. 


Russia’s war with Ukraine is often cited as a primary example of this NTW. Russian 
activities in Crimea showed the significant dominance of irregular tactics and operations 
compared to nearly non-existent usage of the conventional military’s actions to resolve the 
conflict.24 Even using non-traditional or irregular techniques, Russia’s strategy in Ukraine 
has been different and multifaceted. Frank G. Hoffman argues that Russia’s actions in 
Crimea may have been unexpected because it illegally used its advanced military 
capabilities in officially unidentifiable forms and combined them with irregular forces and 
tactics. But he says that in eastern Ukraine, the methods are examples of classical hybrid 
warfare, seen even before the twenty-first century, where the Russian military, with its 
multiple capabilities, plays a significant role in cooperation with non-state actors.2> What 
seems to make Russian actions in Ukraine different from the previous understanding of 
war, or even so-called classical hybrid warfare, is that Russia built up its whole campaign 


on an NTW strategy, trying to win the entire conflict using primarily NTW. 


21 Timothy L. Thomas, Russian Military Thought: Concepts and Elements, MP190451V1 (McLean, 
VA: Mitre Corporation, 2019): 4—11—4-12, 5-1, https://www.mitre.org/sites/default/files/publications/pr- 
19-1004-russian-military-thought-concepts-elements.pdf; Charles K. Bartles, “Getting Gerasimov Right,” 
Military Review 96, no. 1 (January-February 2016): 33, https://www.armyupress.army.mil/Portals/ 
7/military-review/Archives/English/MilitaryReview_20160228_art009.pdf. 


22 Bartles, “Getting Gerasimov Right,” 33. 
23 Bartles, 33-34. 


24 Vladimir Rauta, “Towards a Typology of Non-State Actors in “Hybrid Warfare”: Proxy, Auxiliary, 
Surrogate and Affiliated Forces,” Cambridge Review of International Affairs, (2019): 4, https://doi.org/ 
10.1080/09557571.2019.1656600; Lanoszka, “Russian Hybrid Warfare and Extended Deterrence in 
Eastern Europe,” 178; United States Army Special Operations Command, “Little Green Men”: A Primer 
on Modern Russian Unconventional Warfare, Ukraine 2013-2014, (Fort Bragg, NC: USASOC, 2015): 
49-52, https://www.jhuapl.edu/Content/documents/ARIS_LittleGreenMen.pdf. 


25 Hoffman, “Examining Complex Forms of Conflict: Gray Zone and Hybrid Challenges,” 38-39. 
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This thesis seeks to contribute to this debate through an evaluation of Russia’s use 
of non-state actors to achieve its foreign policy objectives in Europe and the United States. 
In so doing, it will help shed light on whether Russian NTW operations can be successful 


if they do not involve the use of significant armed force. 


D. POTENTIAL EXPLANATIONS 


The central proposition to be evaluated in this thesis is that Russia’s activities using 
unconventional means are more efficient and effective in an environment close to Russia 
geographically, with historical ties and cultural similarities and convenient preconditions 
for action. Factors such as a Russian diaspora, Russian language-speakers, are argued to 
be conducive to successful Russian NTW operations. The effectiveness of Russia’s 
unconventional techniques is posited to decline in countries where these factors are absent 
and where vulnerabilities need to be created rather than exploited. Additionally, this thesis 
evaluates the proposition that Russian NTW operations are less effective when they lack 
the use of armed forces, unlike in the cases in Georgia, Ukraine, Libya, and Syria. The 
expectation is that Russia is less likely to use overt force against countries that are members 
of North Atlantic Treaty Organization (NATO) and the European Union (EU). According 
to the second proposition then, Russian NTW operations should be less effective in EU and 
NATO countries than in non-member countries. Examination of these countries and the 
non-member countries allows for refinement of our knowledge regarding whether and how 
covert, low-scale Russian-sponsored violence can successfully accomplish Russian 
objectives. A third proposition is that non-state actor coordination or independence impacts 
the effectiveness of Russian NTW. The expectation is that coordination will improve 


effectiveness while independence impedes it. 


E. RESEARCH DESIGN 


To evaluate these propositions, the thesis compares two case studies where Russia 
has used irregular means. The cases are chosen based on varying geographical proximity 
and historical ties to Russia. In each study, I conduct an analysis that provides an overview 
of Russia’s activities and—given the nature of the region and the situation in the target 
states—its choices of which non-state actors to use to achieve its goals, as well as their 
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relative success. The first case study centers on Estonia. Estonia, a post-Soviet state located 
in the so-called Russian near-abroad, is a NATO and EU member but remains in the strong 
sphere of the Russian Federation’s interest and influence. The second case study 
investigates Montenegro. This case offers differing degrees of non-state actor coordination 


by Russian state agencies, allowing for evaluation of the third proposition. 


The case studies examine which non-state assets Russia has used in different 
environments, the results in terms of Russian success or failure, and whether the cases have 
been resolved or remained open. This analysis makes it possible to determine whether and 
in which conditions and situations Russian non-state assets and techniques are successful, 


partially successful, and unsuccessful. 


I search for indicators of what violent and non-violent non-state actors Russia has 
used or tried to use in the countries described. If at least two sources confirm that Russia 
has used one or more actors whose description and character overlap with the actors defined 
in Chapter II, I can include them in my case studies. After identifying the actors’ use in the 
target country, I examine how and to what extent Russia used them as well as the result. 
Hence, I can determine what has changed in the target country after Russia’s use of non- 
state actors, whether country-specific cases are resolved, open, or so-called frozen, and the 
target state’s and Russia’s relations afterward. Analyzing this way, I can point out what 
impact the Russian methods have had in different regions and what the probable reasons 
are for their success or failure. Consequently, I can point out which non-state actors Russia 


is likely to continue to use or develop in different regions in the future. 


Finally, a scheme is compiled, showing which non-state actors Russia employs, 
how they are linked to the Russian leadership, and their cooperation with each other. This 
thesis’s source materials include academic articles and books that describe and analyze the 
actors and their previous use and cases that are investigated. Also, newspaper articles and 


open-source materials are used to support the analysis using the latest information. 


F. THESIS OVERVIEW 


Chapter IT examines the literature on Russian hybrid warfare and gives an overview 


of different state and non-state actors that Russia uses in its hybrid campaigns, and the 
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types of coordination possible among them. The examination generates a schema to be 
completed through the empirical investigations of non-state actor usage and the 
effectiveness of such methods. Chapter HI examines Russia’s irregular use of non-state 
actors in Estonia, a former Soviet republic and now member of the EU and NATO. Chapter 
IV similarly analyzes Montenegro. The final chapter draws conclusions about the three 
propositions, and the relative effectiveness of Russian irregular operations and the 
conditions that facilitate or impede them. The chapter provides a scheme based on the 
author’s conclusions about the types, degrees of coordination, and probable pattern of using 
non-state actors in building up the NT'W campaign. In addition, two more mini-studies, the 
Catalan referendum in Spain in 2017 and North Macedonia’s aspirations to join NATO, 


are examined to confirm the drawn conclusions. 


THIS PAGE INTENTIONALLY LEFT BLANK 
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Il. THE CONCEPT OF RUSSIAN NEW-TYPE WARFARE 


A. INTRODUCTION 


Whether Russia’s contemporary approach to warfare is novel or not—and there are 
compelling arguments on both sides—the actual question may be: Could Russia 
increasingly achieve, in today’s globalized and technology- and information-rich 
environment, its political objectives—eroding Western solidarity and unity—without 
resorting to the direct use of significant military assets? The notion of hybrid warfare, as it 
is unraveled, looks at the different phases of conflict and focuses on undermining the 
enemy in the first phase, seemingly peacetime, to prepare the ground for later phases of 
conflict. We need to divide up the conflict concept and see if Russia can achieve its goals 
mainly by non-military means, just by owning and threatening to use its military force, but 


not actually using it. 


Russia’s modern conflict with the West is primarily a confrontation and a struggle 
over values. It is highly unlikely that great powers with nuclear weapons are willing to get 
into a military confrontation with each other. This was already evident during the Cold 
War. But if the contemporary struggle between Russia and the West is not about occupying 
and then physically controlling territory, then why would it be necessary to include the 
kinetic military warfare part to the campaign? In such a case, Russia needs time to 
undermine and fracture the West’s cohesion consistently, and in that case, the use of non- 
state actors combined with information operations and cyberattacks would be the key 
players in this societal, psychological-informational, and remote conflict. These means— 
considerably cheaper than conventional and nuclear capabilities—provide deniability to 
Russia and create confusion and disagreements in the West. If these means can accomplish 
the political objectives of creating strong distrust not only of democracy, but Western 
organizations and Western unity, then Russia has already won. To that end, Russia 
considers it important to be active and find ways to divide the West in areas where it is 
easiest and where Russia feels more comfortable—often in its “near-abroad.” It is also 
crucial for Russia to maintain its existing influence in regions that are often also in its 


immediate neighborhood, such as Georgia and Ukraine. 
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One of the central questions in the debate about Russian “new-type” warfare is, “is 
Ukraine unique?” This question is a side issue, and it does not matter whether Ukraine is 
unique if the actual problem is whether Russia can achieve its goals without having to 
conquer territory. If this is the case, then the most critical part of the whole concept of 
hybrid war or NTW is the first stage, the so-called preparation phase for later stages. What 
does make Ukraine unique is that stage one was already built-in due to Soviet history, and 


that goes to emphasize the relevancy of Russia dominating the first stage of a conflict. 


What if dominating in the first stage and ultimately winning just the initial phase is 
enough for Russia to defeat opponents in a globalized and information-laden world? This 
argument suggests that non-state actors play an essential role in the first phases of Russian 
activities in trying to weaken or dismantle the target state as much as possible. If the target 
states are members of an organization such as NATO or the EU, an additional goal would 
be to alienate and divide the target states from other member states to isolate the target and 
shatter the organization’s cohesion. So, at the end or in the decisive phases of conflict, 
Russian military forces would have the most straightforward task to formalize the job with 
minimal effort because the targets, now sufficiently and deeply politically divided, are 
unlikely to or incapable of implementing a coordinated anti-Russian policy. An even more 
favorable option would be that military combat operations would not be necessary at all, 
as non-state actors’ activities would have thrown the target states into chaos, and the 
organizations to which they belong would be divided, fragmented, and experiencing 


existential threats. 


We first need to understand the debate about the novelty of Russia’s way of warfare. 
Then we can turn to the central question of whether Russia can achieve its aims without 


significant use of force, leveraging only the background presence of its hard power. 


B. CONTEMPORARY WARFARE 


How much does contemporary warfare differ from warfare of the past? Andreas 
Krieg and Jean-Marc Rickli emphasize that “the entire socio-political and geo-strategic 
context in which warfare in the twenty-first century is conducted, is fundamentally 


different from the purely Westphalian, Clausewitzian ideas of warfare that were prevalent 
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in the late eighteenth, nineteenth and twentieth century.”2© In the past, war was 
characterized and built on three main pillars: 1. Objectives, which consisted of defense and 
attack; 2. Means that involved nuclear and conventional capabilities; 3. The scale of 


struggle, which adjusted strategic, operational, and tactical operations.2/ 


In the 1990s, however, the U.S. military and Department of Defense increasingly 
started to talk about a fourth pillar, the forms of war, which consist of: “information 
warfare; precision warfare (which features information processing, stealthy, remote, and 
non-contact attacks, and speed, accuracy, and limited casualties); joint operations; and 
military operations other than war (MOOTW).”28 Today, countries seek to achieve goals 
in indirect contactless campaigns. In these campaigns, the strategic, operational, and 
tactical layers and offensive and defensive actions have become less distinct.2? National 
armies are not a key element in influencing outcomes because “the state in the twenty-first 
century is frequently seeking to externalize the weight of warfare to human and 
technological surrogates.” Along these lines, in 1999, Chinese People’s Liberation Army 
Colonels Qiao Ling and Wang Xiangsui introduced the Combination Warfare concept.3! 
It was an analysis of modern warfare that emphasized that a purely military option is only 
one part, like a ‘Lego’ piece, which can be added to the conflict to complicate opponents’ 


overall picture.32 





26 Krieg and Rickli, “Surrogate Warfare: The Art of War in the 21* Century?,” 113. 


27 James Callard and Peter Faber, “An Emerging Synthesis for a New Way of War: Combination 
Warfare and Future Innovation,” Georgetown Journal of International Affairs 3, no. 1 (2002): 62, 
https://www.jstor.org/stable/43 133476. 


28 Callard and Faber, “An Emerging Synthesis for a New Way of War: Combination Warfare and 
Future Innovation,” 62. 


29 United States Army Special Operations Command, “Little Green Men,” 18. 
30 Krieg and Rickli, 113-114. 

31 Callard and Faber, 62. 

32 Callard and Faber, 63. 
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Previously, the irregular and conventional “components occurred in different 
theatres or in distinctly different formations.”33 Now, these forces blend into common 
forces in the same “battlespace,” where they are operationally combined and tactically 
mixed. Remarkably, the unconventional component of the force becomes dominant.34 The 
battlespace is not necessarily territorial, but it is necessarily societal. The combination of 
contemporary hybrid threats, a variety of lethal and non-lethal elements—the results of 
globalization, the dissemination of military technologies, and the information revolution— 
are qualitatively distinct from less complicated dangers posed only from unconventional 


or paramilitary troops.>> 


Today, in principle, non-hybrid wars no longer occur, and conflicts that lead to 
armed confrontations begin long before the war is officially recognized and end only long 
after the signing of the peace treaty.3© They start in the form of information wars, acts of 
diversion, and guerrilla fights, which is also the basis of modern military planning at the 
level of the Russian General Staff.37 Modern warfare is a nodal-style conflict where one 
has to attack particular connections, control elements, and centerpieces of the enemy’s 


build-up.38 To fulfill the goals, different elements, seemingly unconnected in time and 


33 Frank G. Hoffman, Conflict in the 21st Century: The Rise of Hybrid Wars (Arlington, VA: Potomac 
Institute for Policy Studies, 2007), 8, https://potomacinstitute.org/images/stories/publications/ 
potomac_hybridwar_0108.pdf. 


34 Hoffman, Conflict in the 21st Century, 8. 
35 Hoffman, “Examining Complex Forms of Conflict: Gray Zone and Hybrid Challenges,” 38. 


36 Jaanus Piirsalu, “FSB Infosdjaspets: Venemaa Loob Kiiresti Oma Erasdjavaetiksused” [FSB 
Information Warfare Specialist: Russia Is Rapidly Setting up Its Private Military Units], Diplomaatia 
[Diplomacy], June 10, 2016, https://diplomaatia.ee/fsb-infosojaspets-venemaa-loob-kiiresti-oma- 
erasojavaeuksused/. 


37 Piirsalu, “FSB Information Warfare Specialist: Russia Is Rapidly Setting up Its Private Military 
Units.” 


38 Jeffrey Larsen, “Principles of Russian Foreign Policy” (online lecture, NS4000: Great Power 
Competition: Current Policy and Strategy course, Naval Postgraduate School, Monterey, CA, August 
2020): 23:38—23:52, https://cle_nps.edu/portal/site/863193e1-160e-4b64-ad3b-ad9d6c 187b4a/tool/ 
0a0b5489-a809-4e3b-96e0-25406d17070b. 
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space, are used simultaneously.39 Chief of the Russian General Staff, General Gerasimov 
said in 2016 that modern war is prepared and supported by information influencing, 
including the use of the Internet, to change mass consciousness; this can occasionally 
replace armed intervention.49 Warfare conducted mainly by non-state actors who are 
supported by seemingly indirect means is likely to become the new norm in the twenty- 


first century’s war and future security environment.4! 


C. RUSSIAN UNDERSTANDING OF MODERN WARFARE 


According to Dr. Richard Weitz, a senior research fellow at the Hudson Institute 
and director of the Center for Military-Political Analysis, “Russia’s recent aggressions 
against its neighbors have been accompanied by cyber-attacks, information operations, 
psychological pressure, manipulation of the press, economic threats, acting through 
proxies, crafty propaganda, exploiting ethnic contradictions, and favoring influence agents, 
both conscious and occasional, in foreign countries through the use of influence tools and 
placing blame in ways that could attract a sympathetic audience.”42 One by one, these 
tactics do no significant damage, but together they can weaken the target country and 


prepare the ground for an invasion or incitement to rebellion.43 


From 2013 until 2015, senior Russian military officers published three articles that 


can be considered as representatives of dominant Russian military thought at the highest 


39 Raimonds Rublovskis, “Lati Riigikaitse Aktuaalsed Probleemid Ukraina Konflikti Valguses” 
[Topical Problems of Latvian National Defense in the Light of the Conflict in Ukraine], Diplomaatia 
[Diplomacy], May 17, 2014, http://www.diplomaatia.ee/artikkel/lati-riigikaitse-aktuaalsed-probleemid- 
ukraina-konflikti-valguses/; Bérzin8, Russia’s New Generation Warfare in Ukraine: Implications for 
Latvian Defense Policy. 


40 Larsen, “Principles of Russian Foreign Policy,” 23:15—23:31. 


41 Hoffman, Conflict in the 21st Century, 7; Michéle A. Flournoy and Shawn Brimley, “The Defense 
Inheritance: Challenges and Choices for the Next Pentagon Team,” The Washington Quarterly 31, no. 4 
(September 2008): 60, 63, https://doi.org/10.1162/wash.2008.31.4.59; Joseph S. Nye, Jr., The Future of 
Power (New York, NY: Public Affairs, 2011), 33-39; Raymond T. Odierno, “The U.S. Army in a Time of 
Transition: Building a Flexible Force,” Foreign Affairs 91, no. 3 (May/June 2012): 10, ProQuest Central; 
Krieg and Rickli, “Surrogate Warfare: The Art of War in the 21“ Century?” 127. 


42 Richard Weitz, “Silmitsi Venemaa Hiibriidohtudega” [Facing Russia’s Hybrid Threats], 
Diplomaatia [Diplomacy], November 21, 2014, https://diplomaatia.ee/silmitsi-venemaa-hubriidohtudega/. 


43 Weitz, “Facing Russia’s Hybrid Threats.” 
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echelons.44 All of these high-level Russian officers emphasize that the nature of modern 
warfare and conflict is changing rapidly and continuously, and the key for Russia is to 
develop and adapt to new forms and methods of combat.45 One of these officers, General 
Gerasimov, states that Russia cannot simply copy other countries’ experiences; the 
development of Russian warfare methods must continue uninterrupted until a leading 
position is reached on modernized weaponry and asymmetric warfare vis-a-vis the West.*6 
He emphasizes that the ratio of non-military to military methods in modern conflict is four 


to one.47 


Retired General-Lieutenant Sergey Bogdanov and Colonel in reserve Sergey 
Chekinov emphasize that the keys to success in the new generation of wars are dominance 
in the information sphere and psychological operations that devastate the adversary’s 
defense structures personnel and society both morally and psychologically.48 According to 
the authors, it is essential to establish so-called information and psychological warfare 
superiority. This concept means controlled information pressure, which creates confusion 
and chaos in the target state’s population, through the media, non-governmental and 
religious organizations, propaganda, and deceptive information.49 The primary target of 
destabilizing propaganda would be extremists and radicals among the victim state’s 


population.>9 


In the information-manipulated environment, then, covert agents, supplied with 


necessary funds, weaponry, and equipment, will be infiltrated into the targeted state to 





44 Timothy Thomas, “The Evolving Nature of Russia’s Way of War,” Military Review 97, no. 4 (July- 
August 2017): 41, https://www.armyupress.army.mil/Journals/Military-Review/English-Edition-Archives/ 
July-August-2017/Thomas-Russias-Way-of-War/. 


45 Thomas, “The Evolving Nature of Russia’s Way of War,” 41. 


46 Valeriy Gerasimov, “LlenHocTb HaykH B IpezBuyeHun” [The Value of Science in Foresight], VPK- 
News no. 8, February 27—March 5, 2013, 3, https://vpk-news.ru/sites/default/files/pdf/VPK_08_476.pdf. 


47 Gerasimov, “The Value of Science in Foresight,” 3. 


48 Sergey Chekinov and Sergey Bogdanov, “The Nature and Content of a New-Generation War,” 
Military Thought, 16, 18-19, accessed March 1, 2021, https://www.usni.org/sites/default/files/inline-files/ 
Chekinov-Bogdanov%20Miltary %20Thought%202013.pdf. 


49 Chekinov and Bogdanov, “The Nature and Content of a New-Generation War,” 17-19. 
50 Chekinov and Bogdanov, 20. 
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spread further chaos and panic and incite dissatisfied and rebellious residents against the 
state.>! If the military operations are inevitable, Bogdanov and Chekinov suggest, “Before 
the outbreak of war, nonmilitary measures, such as establishment of no-fly zones over the 
country to be attacked, imposition of blockades, and extensive use of private military 
companies in close cooperation with armed opposition units, may be applied as new 


methods of interstate warfare.’’>2 


In early 2015, General-Lieutenant Andrey V. Kartapolov, then chief of the Russian 
General Staff's Main Operations Directorate, discussed the NTW elements in his speech 
at the Russian Academy of Military Science.53 Kartapolov presents mostly the same 
principles as Gerasimov, Bogdanov, and Chekinov, but covers them from a slightly 
different angle and develops them further. He emphasizes that non-traditional solutions are 
being developed to effectively compensate for Russia’s technological backwardness in 
comparison to its adversaries.°4 Russia uses all the NTW nuances to prepare its 
capabilities, and enemies will be confronted with newly developed asymmetric methods.>> 
He emphasizes that NTW consists of 80 to 90 percent of propaganda and psychological 
operations and 10 to 20 percent of direct violent operations.°© As part of his conclusion, 
General Kartapolov points out that Russia will continue to implement and develop its NTW 
capabilities fully and, in particular, implement asymmetric capabilities in this form, which 


may lead to more novel ways of warfare in the future.>7 


51 Chekinov and Bogdanov, 20. 

52 Chekinov and Bogdanov, 20. 

53 Thomas, “The Evolving Nature of Russia’s Way of War,” 39. 
54 Thomas, 39. 

55 Thomas, 39. 

56 Thomas, 40. 
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D. IS RUSSIAN-PRACTICED NTW REALLY A NOVEL CONCEPT? 


Frank G. Hoffman argues that, concerning Russia, the combination of different 
methods in warfare is the realization of practices and experiences tested over time.> He 
further states that “the Cold War and recent experience with Russia suggests that the 
mixture of political, economic, and subversive activity is a consistent element of their 
operational art.”>? The Soviet Union regularly applied so-called active measures in the 
information realm that included fabrication, propaganda, and inaccurate stories or “fake 
news.”©9 “Active measures” and “assistance programs” or “assistance operations” were 
invented by the Soviet KGB to influence the course of events in a specific country or region 
and to change its policy in ways favorable to the Soviet Union’s position.®! These programs 
were based on 95-percent accurate information to which something was added, changed, 


or nuances manipulated to turn the data into targeted information or disinformation.©2 


There are also other tools of confusing the adversary that have Soviet and even 
Tsarist origins. For example, “Maskirovka, the complex of measures devised to confuse 
the enemy regarding the “presence and disposition of forces, their condition, readiness, 
actions and plans,” has been an object of military-academic study in Russia since 1904,”63 
In many ways, the Cold War can also be considered the spy war, and it was perceived as 
such by the public. During this conflict, Soviet intelligence developed a unique ‘illegals’ 
program, which meant that well-prepared intelligence officers were sent under deep cover 


to foreign countries.o> The ‘illegals’ task was to integrate deeply into the adversary’s 
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60 Hoffman, 32. 
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63 James Sherr, The Militarization of Russian Policy, 2017 Paper Series No.10 (Washington, DC: 
Transatlantic Academy, 2017), 6—7, https://www.academia.edu/34568065/ 
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society and patiently create networks and positions that would give the Soviet Union access 
to the most valuable information. Because spying did not stop with the end of the Cold 
War, direct parallels to the Cold War events are often sought today.67 Gordon Corera states 
that, “It is tempting to talk about a “new Cold War.” That conflict is long gone. There is a 


new one that is being fought today with both old techniques, like illegals, and new ones.”68 


According to James Sherr, there are five significant differences between Russia’s 
contemporary situation and activities and those of the Cold War. First, with the signing of 
the Helsinki Final Act in 1975, the Soviet Union accepted in principle the borders and 
balance of power in Europe.®9 Today, Russia is clearly dissatisfied with the rules agreed 
to in 1975 and seeks ways and justifications to replace them with principles based on the 
great powers’ spheres of influence, where small states have limited sovereignty.’2 Second, 
contrary to light-hearted threats, the Soviet leadership realized the seriousness of the use 
of nuclear weapons, which led to efforts to establish a functioning arms control system 
with the West.7! Nonetheless, the modern Russian Federation has undermined previous 
arms control regime agreements or understandings when it violated, for example, the 
Intermediate-Range Nuclear Forces Treaty or rejected the Treaty on Conventional Armed 
Forces in Europe. 72 Third, the Cold War leaders and decision makers mainly understood 
the standpoint and possibilities of their opponent and themselves./3 Today, Russia’s and 
the West’s assessment of each other’s abilities and intentions are in stark contrast and full 
of uncertainty.74 Fourth, today, in contrast to the Cold War era, Russian “non-linear,” 


“network,” and “new generation” warfare—in the Western understanding “hybrid” 


66 Corera, 6. 

67 Corera, 5. 

68 Corera, 9. 

69 Sherr, The Militarization of Russian Policy, 2. 
70 Sherr, 2. 

71 Sherr, 2. 

72 Sherr, 2. 

73 Sherr, 2. 

74 Sherr, 2. 


19 


warfare—‘“is designed to blur the thresholds between internal and interstate conflict and 
between peace and war.’”’’> Fifth, the demarcation line in the Cold War was far from the 
borders of the Soviet Union.’© Today, the distance has disappeared, and the so-called 
demarcation line runs along or in the vicinity of the Russian Federation’s borders. The 
buffer zone’s disappearance and Russia’s vague threats and actions could lead to 


misunderstandings, unintentional escalation, and loss of control.77 


E. THE IMPORTANCE OF RUSSIAN ARMED FORCES IN NTW 


Skeptics insist that ultimately Russian military might is what has been decisive in 
achieving successes in Ukraine, Georgia, and Syria. In this view, “without the backing of 
hard power, Moscow’s hybrid activities in Europe would not be nearly as effective.’”78 
Hybrid tactics are applied when the use of open military activity is not practical or feasible, 
but the Russian Federation’s hard power is always perceptible in the background.’9 Hybrid 
warfare and even covert operations have strength and potential only if the aggressor has 
capable combat forces as a reserve that, if necessary, can be used to threaten and escalate 
the situation to the next level.89 Ivo Juurvee and Mariita Mattiisen state that, “both Russia’s 
practice and doctrine leave the door open for deliberate escalation of hybrid conflict to 


war.”’81 


Russia is trying to use a combination of means that give it the flexibility to react to 


changing events and force the adversary to act in an environment shaped by Russian 
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rules.82 If the situation requires the use of conventional Russian units, “mobility, shock, 
striking power, and speed matter as much they did in the past.”83 For example, when 
Russian-supported Donbas separatists in eastern Ukraine were on the verge of destruction 
in 2014 and 2015, Russia activated and included its nearby battle elements to that struggle 
and turned around the unfavorable course.84 Moscow has thus shifted the combined-arms 
concept to the so-called all-domain concept that incorporates its conventional military with 
psychological-informational means, special purpose forces, and non-state actors.85 This 
concept seeks to accomplish determinant effects in the opening stage of the war and “as 
demonstrated in Ukraine, it is possible today to achieve strategic objectives before the 


adversary realizes that war has begun.”86 


The Russian Federation’s mobilization for a state of war differs significantly from 
the Soviet version. In the past, a state of war meant the activities of a massive army at the 
strategic level, along with the activation of all the vast support functions that made it 
possible.87 During the Cold War, the Soviet state’s mobilization also included the 
activation of nuclear weapons.88 The state of war in modern times, Russia’s present 
military leadership maintains, contrasts sharply with the Second World War model and 
even from the Cold War conflict. In contemporary conflicts, the difference rests in the 


technological and “psychological-informational” environments.8? 


F. RUSSIA’S STRUGGLE FOR VALUES AND INFLUENCE, NOT 
NECESSARILY FOR TERRITORY 


The Russian Federation in today’s world “‘is setting itself up as an ideological 


alternative to the EU [and the West], with a different approach to sovereignty, power and 
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world order. Moscow believes that laws are mere expressions of power—and that when 
the balance of power changes, laws should be changed to reflect it.”90 Hence, Russia is 
pursuing an aggressive, wide-ranging, and multifaceted campaign to fragment European 


unity and to prevent it from interfering or challenging its ‘near abroad’ actions.?! 


Russian security executives continue to display the belief that keeping NATO under 
pressure could eventually fatigue some members’ loyalty to the organization and hope that 
a combination of internal disputes in the EU and Russia’s own machinations will fragment 
the unity of the Union.?2 To this end, Russia displays the preparations of its armed forces 
and threatens to use them, if it considers that it is cornered by the West and other methods 
have been exhausted to protect its interests and security.?3 Thus, Russia’s unpredictable 
and extensive NTW activity, the combination of military and non-military elements, is 
designed to exhaust adversaries by causing confusion and disputes among them.” It is 


complicated for international bodies such as NATO and the EU to find answers to this.?> 


The Russian leadership understands that it cannot win a long-term war against 
NATO and the United States because it is outmanned, outgunned, and outspent by the 
West.26 Perhaps Moscow’s greatest disadvantage is its lack of universal ideology, but it is 


trying to exhaust the West by undermining Western narratives and ideology.?7 Mark 





90 Mark Leonard and Nicu Popescu, A Power Audit of EU-Russia Relations (London, UK: ECFR, 
2007): 1, https://www.ecfr.eu/archive/page/-/ECFR-02_A_POWER_AUDIT_OF_EU- 
RUSSIA_RELATIONS. pdf. 


91 Mark Galeotti, Heavy Metal Diplomacy: Russia’s Political Use of its Military in Europe since 
2014, ECFR/200 (London, UK: European Council on Foreign Relations, 2016): 1, https://ecfr.eu/wp- 
content/uploads/Heavy_Metal_Diplomacy_Final_2.pdf. 


92 Galeotti, Heavy Metal Diplomacy: Russia’s Political Use of its Military in Europe since 2014, 8. 
93 Galeotti, 1. 


94 “What Russia Wants: From Cold War to Hot War,” Economist, February 14, 2015, http://www. 
economist.com/news/briefing/2 1643220-russias-aggression-ukraine-part-broader-and-more-dangerous- 
confrontation. 


95 “What Russia Wants.” 
96 Larsen, “Principles of Russian Foreign Policy,” 19:30—19:40. 


97 James Rogers and Andri Tyushka, “Venemaa ,,Hegemooniavastane” Pealetung: Uus Strateegia 
Praktikas” [Russia’s ““Anti-hegemonic” Attack: A New Strategy in Practice], Diplomaatia [Diplomacy], 
December 16, 2016, https://diplomaatia.ee/venemaa-hegemooniavastane-pealetung-uus-strateegia- 
praktikas/. 


22 


Galeotti refers to the mindset of a group of unidentified Russian intelligence, “If the West 
loses, we gain,” as best at describing the Russian approach.?8 For that reason, Moscow has 
adopted a hybrid approach in conjunction with nuclear intimidation to try to fragment the 


unity and the cohesion of Europe and the West.?? 


Russia believes that contemporary methods or operations endeavor to apply nearly 
constant pressure in a unified influence space.!09 The aim is to weaken opponents from 
within. Reducing the state’s security, as well as its economic and political capability, before 
the actual so-called war starts accomplishes this weakening.!0! The campaign’s primary 
goal is not the physical occupation of the territory but to secure Russia’s influence in the 
target country or area and make its policy useful to Russia. According to General 
Gerasimov, in the event of war, the modern environment provides an opportunity to ensure 
the rapid destruction of critical infrastructure and military resistance without the use of 
massive armies or nuclear weapons.!02 Even war—the third phase, involving kinetic 
military action—translates as using only necessary military units and, if possible, entering 
the country under some cover, such as peacekeepers, to pacify the territory and eventually 
install a government that favors and supports the aggressor.!03 However, the fact that 
Russia would feel confident in starting a rapid and successful military operation 
presupposes the existence, amplification, or creation of favorable pre-conditions on the 


ground by non-kinetic military means and non-state actors. 
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G. NON-MILITARY ASSETS AND MEANS THAT RUSSIA EXPLOITS 
AGAINST ITS ADVERSARIES 


This thesis has a central focus on the numerous non-state actors acting on the orders 
of Russian state entities engaged in Russian NTW. Non-state actors are tools in the arsenal 
of Russian NTW, and their activities and use are covertly coordinated and managed by 
Russian special services. This thesis proposes that these actors are key factors in the relative 
success or failure of Russian NTW operations. To analyze non-state actors’ actions, it is 
also necessary to understand the Russian national special services’ activities and roles. The 


next section describes the central state and main non-state actors involved in Russian NT W. 


1. Russian State Actors 


This thesis examines the main state actors involved in Russian NTW, particularly 
the Main Directorate of the General Staff of the Armed Forces of the Russian Federation 
(Indenoe ynpaenénue I enepdabuozo wmdba Boopyacéuneix Cun Poccuuckou Pedepayuu 
—T-.Y., the G.U.), formerly the Main Intelligence Directorate (/ 7denoe pa3zeédvieamenbHoe 
ynpaenénue — TPY, the GRU).!94 The agency is still commonly known by its previous 
abbreviation, the GRU, which is used in this thesis. The second state actor is the Federal 
Security Service of the Russian Federation (®edepaabuaa ciyocba bezonacnocmu 
Poccuucxou @Pedepayuu — OCB, the FSB). The third is Russia’s Foreign Intelligence 
Service (Czyorc6a eHéwHeu pa3seédxu PoccuucKkou Pedepayuu — CBP P®, the SVR). 
Contrary to Soviet practice, where the KGB held most of its intelligence and security 
responsibilities, Russia’s modern approach is more diverse, and many of the tasks, 


activities, and areas of responsibility of the three main intelligence agencies overlap.!0 


a. The GRU 


The GRU, becoming more active worldwide to operate without diplomatic cover, 


seems to be the leading Russian intelligence agency for managing organized crime, 
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insurgents, and other violent non-state actors abroad.!06 Russian intelligence agencies play 
an even more significant role in eastern Ukraine than they did in Crimea.!97 Besides using 
its specialized units (Spetsnaz), the GRU appears to be the primary entity in creating and 
managing the auxiliary groups.!08 The Ukraine conflict shows that the GRU recruits 
criminals, political dissidents, minorities, and pro-Kremlin nationalists from among the 
locals in the target country.!09 When these agents are activated, they work mainly for 
Spetsnaz and carry out largely non-kinetic tasks, such as political agitation, to create a 


political situation suitable for the Russian Federation. !10 


The GRU is also closely connected with Russian private military companies 
(PMC), whose activities and operations abroad are growing and becoming more frequent. 
An analysis by Johns Hopkins University states, “Open-source analysis performed and 
published by Bellingcat on the role of the Russian Federation in Donbas—supported by 
public interviews given by separatist leaders, intelligence published by the Ukrainian SBU, 
and other open-source data—has produced the clearest public demonstration of Russian 


GRU command and control over Russian PMC forces operating abroad.”! 11 


Kiev and the Western agencies have accused both Russian services, the GRU and 
the FSB, of terrorism-related campaigns behind the Ukrainian lines.!!2 Among Russia’s 
special services, the GRU probably has the best technological and operational capability 


for conducting cyber operations.!!3 The GRU demonstrated its capabilities against the 
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French TV network TV5Monde when the Russian “false flag” operation nearly destroyed 
the French network by shutting down twelve broadcasting channels in 2015.!!4 The 
conclusion was that the GRU’s aim was not an espionage attempt to steal secrets but a test 
of its cyber weapons and their destructivity.!!5 Around 2015, Russian intelligence services 
modified their cyber tactics.!!© They began combining hacking and leaking, which refers 
to digital espionage and active measures. The GRU has set up at least six front bodies to 
distribute information: Yemen Cyber Army, Cyber Berkut, Guccifer 2.0, DC Leaks, Fancy 
Bears Hack Team, and @ANPoland.!!7 More such groups have also been created, and 
their names may have changed over time.!!8 As it is difficult to define the specific motives 
and other details of their activities, it is believed that the FSB rather than the GRU may be 


behind some groups.!19 


b. The FSB 


The FSB, a successor service of the KGB, is the primary internal security agency 
in Russia.!20 The head of the FSB reports directly to the Russian Federation president and 
holds a position equivalent to a minister.!2! The service’s responsibilities cover 
intelligence, counterintelligence, counterterrorism, border protection, fighting organized 


crime, and ensuring information security.!22 The FSB is experienced in cooperating with 
g y p p g 
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proxy forces and groups—together with the (Russian) Ministry of Internal Affairs (MVD), 
they were the leading agencies that directed proxy forces in the Second Chechen War 
(1999-2009). 123 Similarly to the GRU, the FSB also actively runs and commands the 
activities of proxies today. The FSB, considered as the primary domestic security agency, 
has also been associated with international organized crime!24 and actively conducting 
psychological and information operations abroad.!25 The FSB is known to run a variety of 


°’ 


so-called political “active measures,’ from using proxies and agents to spread 


misinformation to attempting to corrupt and influence Western politicians.!26 Tomas Cizik 
argues that separatists in eastern Ukraine, equipped with modern Russian military 
equipment, have apparent links with the FSB.!27 Russian intelligence agencies have 
invested heavily in influence agents, whose mission abroad is not to steal secrets but to 


provoke unrest and discontent to turn the populace against their government.!28 


The FSB covers its cyber-attacks by exploiting and managing autonomous hackers 
and using its high-end cyber-espionage capabilities.!29 For example, “the Russian 
Business Network (RBN), a cyber-criminal organization active since 1996, was founded 
by individuals with direct connections to the Russian military and the FSB.” !30 The RBN’s 
founder, known as “Flyman” is a relative of some of St. Petersburg’s political members, 


the same network of officials that gave rise to President Putin.!3! Others who formed the 
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RBN were former members of the FSB.!32 The most sophisticated cyber espionage is not 
conducted by criminal hackers but by the FSB’s elite hacker unit, code-named “Turla,” the 
successor to the KGB signal intelligence unit acquired by the FSB.!33 This unit is known 
as a highly advanced and stealthy cyber-espionage player that, among other tasks, 
conducted the “Buckshot Yankee” breaching operation against the U.S. military in 
2008.!34 Over time the group has also been identified using names such as Snake, 
Uroburos, VENEMOUS BEAR, or Waterbug.!35 Having a global grasp, the group has also 
more recently breached into embassies, foreign affairs ministries, and other government 
agencies across Europe and former Soviet republics.!36 In Russia’s cyber operations and 
strategy against the West, intelligence agencies are likely to be forced to cooperate, 
especially if the target is a strong and powerful adversary such as the United States or a 
group of countries. Given its role in the hacking and leaking tactics that started in 2015, 


Turla is likely to play a vital role by covering a portion of the hacking part. 


c. The SVR 


The SVR’s main task has traditionally been to gather foreign intelligence on topics 
such as the economy, technology, and defense to support Russian state-level decision- 
making, using human intelligence (HUMINT) case officers both under diplomatic cover 


and covert operatives under the code name ‘illegals.’ !37 The GRU uses a similar modus 
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operandi, and one of their main tasks is to gather foreign intelligence,!38 but the GRU’s 
focus is more military-specific. Nevertheless, the SVR is very actively, together and in 
parallel with the GRU and the FSB, supporting European organizations that include 
environmental movements, nationalist and anti-governmental political groups, Russian 


diaspora campaigns in the Baltics, and separatists from South to North.!39 


Even though the SVR is principally concentrating on HUMINT, it also holds the 
capacities to carry out signals intelligence (SIGINT) and wiretapping on fixed and wireless 
lines.!49 Many recent investigations reveal that in Ukraine, the SVR, concurrently with the 
FSB, has been heavily deploying its special groups to the region, and indirectly organizing 
separatists’ actions, conducting information campaigns, cyber-attacks, and providing 
intelligence.!4! The U.S. Department of State’s Global Engagement Center (GEC) 
reported in August 2020 that the SVR manages an online journal, The Strategic Culture 
Foundation, which holds a central position in a group of associated websites that 
disseminate Russian disinformation and propaganda. !42 According to the GEC, the journal 
“is a prime example of long-standing Russian tactics to conceal direct state involvement in 
disinformation and propaganda outlets, and to cultivate local voices to serve as surrogate 


messengers.” !43 


2. Russian-Backed Non-violent Non-state Actors 


Cyberspace has made it possible to adopt handy, more accessible, and faster tactics 


to gain a strategic advantage in warfare.!44 In cyberspace, the winners are not the countries 
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with better technology.!45 They are the ones who can effectively combine the various 
cyber-elements, and gradually develop these elements to achieve strategic goals 
effectively.!46 “Russia’s approach to cyber operations is divided into two: information- 
technical, which overlaps with the Western definition of electronic and cyber-warfare and 
focuses on technical capability; and information-psychological, reminiscent of Western 
strategic communication and psychological operations, which focus on influence 


operations.” !47 


Information operations are a mixture of propaganda, disinformation, diplomatic 
ambiguity, manipulation of the press, and outright falsehoods designed to confuse, produce 
discontent, and divide the public and government in the country of destination and 
elsewhere.!48 Psychological operations use Russian-controlled media and agents to create 
a narrative in favor of the Kremlin, to incite subversion of the target population through 
so-called controlled chaos, and to intimidate civilian support networks, such as military 


counterparts. !49 


Notably, Russian peacetime and wartime cyber strategies are similar.!59 In 
peacetime, Russia’s intention is to isolate the targets, change opinions with disinformation 
and propaganda, and weaken rivals internally.!5! Russia’s cyber actions in Georgia and 
Ukraine showed that its cyber strategy supports the wider hostile campaign only minimally 
in conflict.!52 Cyber-attacks and other malign activities in cyberspace have been 


effectively used against Russia’s neighbors, such as: Estonia (2007); Lithuania (2008); 
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Georgia (2008);!53 Ukraine, more precisely in Crimea (2014); and also against the United 
States (2016) and France (2017). 154 


Russia’s cyber apparatus is intertwined with a vast criminal web that creates a 
synergy between the cyber-criminal underworld and the Russian security agencies and 
other entities part of cyber operations.!55 Russia’s special services use cybercriminals and 
so-called patriotic hackers to cover up their activities more effectively,!5° and keep 
capabilities improvement costs more favorable.!57 Cybercriminals are mainly used for 
espionage and data collection to carry out further operations.!58 Patriotic hackers are 
seemingly unrelated to the state’s interests and special services but regularly activate 
during a military or a geopolitical conflict in which Russia’s interests are at stake.!9? Their 
main activities are website breaches, denial of service attacks, and spreading 
misinformation to disturb the state and society’s essential services.!©9 So far, Moscow’s 
pattern of cyber-attacks shows three waves: before the conflict, it delegitimizes and 
disorients the target; in conflict, the cyber activity supports kinetic operations; and after the 
first phase of combat, it creates, in cooperation with systematic active measures, the 


disorder that attempts to fracture the legitimacy of the state victim. !6! 


Although the cybersphere plays an essential role in Russia’s propaganda and 
disinformation campaigns, the U.S. State Department’s GEC states that it is only one of 


the five principal pillars of Russia’s so-called disinformation and propaganda 
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ecosystem.!62 This “ecosystem” is “the collection of official, proxy, and unattributed 
communication channels and platforms that Russia uses to create and amplify false 


narratives.” 163 


Besides cyberspace, the other four pillars are formal government communications, 
state-funded worldwide messaging, cultivation of proxy sources, and arming of social 
media.!64 Official government communication is the most overt and consists of statements 
of the Kremlin or ministries, formal Russian media reports, and comments and quotes by 
Russian officials.1> State-funded global messaging relies on Russian-funded foreign- 
oriented media; Russian internal media; international, but Russian-funded media; and 


international Russian socio-cultural organizations. !66 


Proxy sources add Russian-linked outlets with global grasp, local language-specific 
outlets, deliberate and unwitting distributors of Kremlin narratives, and foreign narrative 
amplifications.!©7 Social media’s weaponization covers the infiltration of domestic 
conversations, campaigns to undermine people’s trust in institutions, and elaboration of 
target-state protests or civil disputes. !©8 Finally, cyber-enabled disinformation is the most 
covert and deals with hacking and releasing, website captures, cloning sites, forgeries, and 


meddling with official sources or objective media.!69 


3. Russian-Backed Violent Non-State Actors 


Indirect forces are the vital tools Russia uses to exploit the existing vulnerabilities 


or attempts to destabilize the target state while creating vulnerabilities.170 These indirect 
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actors are commonly called proxies, but Vladimir Rauta has gone into specifics and divides 
these indirect elements into separate categories: affiliates, auxiliaries, and proxies.!7! In 
addition, Russian transnational criminal organizations are another indirect force. Every 
type of indirect force has its role in sabotaging and fighting the target state, its security 


forces, and government. !72 


a. Affiliates 


Affiliates are described as armed formations that are informally part of the state’s 
troops and, while being external actors, aim to change the strategic outcome of the conflict 
in favor of the state.!73 Affiliated groups possess “a symbiotic, formal, yet legally dubious 
relationship with the state acting as an invisible arm.”!74 These can be mercenaries grouped 
and formed into private or contract armies capable of independent military campaigns, 
attack operations, and projection of force!7> or shadowy private companies that provide 
their clients with versatile options of military and security services.!7© In Ukraine, the 
majority of affiliated forces activities have been related to the Wagner Group, a firm of 
mercenaries veiled in secrecy that is now active also in other regions, such as Syria, Sudan, 
Libya, the Central African Republic, and Venezuela among others.!77 PMCs offer Russia 
the opportunity to project power abroad cheaply and deniably, and Russia is increasingly 


using this easily scalable capability.!78 Russia uses these groups as force multipliers to 
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fulfill its national and Russian-related private interests in the target country or region for 
the lowest possible political and military cost.!7? PMCs can be quickly sent into and 
brought back from a conflict or area of interest, and often they operate there in collaboration 
with other non-state actors and local groups.!89 Also, PMCs’ use is beneficial for Russia 
because, compared to reports of soldiers killed and injured in foreign operations, the news 
of PMC members’ casualties do not have as much impact and are more easily suppressed 
in Russia.!81 Yet, Moscow must carefully manage the PMCs’ activities, as losing control 
of their actions could create a situation in the target country that is not in line with Russia’s 


goals, 182 


b. Auxiliaries 


Auxiliaries are armed groups formed from volunteers who do not belong to regular 
forces but are directly participating in the operating environment in collaboration with or 
beside military troops deployed to the target state.!83 They therefore “act as force 
multipliers, in defensive or offensive roles, accompanying or being accompanied by 
regulars in operation.” !84 In Crimea, the auxiliaries committed to diverse activities from 
creating and taking part in pro-Kremlin protests to road blocking and other attempts to 
support the invading unmarked Russian units and enforce the peninsula’s occupation.!8> 
In the kinetic operations of the campaign, local self-defense groups accompanied the 
Russian Spetsnaz units, and the former can be identified as auxiliaries. 186 Tn Crimea, many 


auxiliaries had a criminal background because the peninsula “has a long history of 





179 Johns Hopkins University Applied Physics Laboratory, Russian Private Military Companies, IX. 
180 Bowen, Russian Private Military Companies (PMCs). 


181 Nils Dahlqvist, Russia’s (Not So) Private Military Companies, FOI Memo 6653 - Project No: 
A19101 (Stockholm, Sweden: Swedish Defence Research Agency, 2019), https://www.foi.se/ 
rapportsammanfattning ?reportNo=FOI%20MEMO%206653. 


182 Johns Hopkins University Applied Physics Laboratory, Russian Private Military Companies, IX. 
183 Rauta, “Towards a Typology of Non-State Actors in ‘Hybrid Warfare,” 10. 

184 Rauta, 10. 

185 Rauta, 10. 

186 Rauta, 10; Galeotti, “Hybrid, Ambiguous, and Non-Linear?” 284—295. 


34 


criminality, turf wars and gangs.”!87 In the operations, they were military auxiliaries who 
carried out Russia’s goals.!88 Russia funds and supports the various military, shooting, 
martial arts, and history organizations and clubs in several European countries.!89 And “it 
has been thoroughly reported in the media that Russia sponsors numerous tactical training 
organizations in the Baltic States and the Balkans including paintball, airsoft, and knife 
fighting clubs to recruit and exert influence.”!99 For example, in Estonia and Latvia, 
instructors with a background in the Russian military and even special units have taught 
tactics in various Russian-language clubs, which have been described by observers as 


“small unit tactics”.!9! 


é Proxy Forces 


Proxies are “third party forces that are employed by a state in any external conflict 
where the employment of its own forces may be deemed undesirable.” !9 These are “armed 
groups that are not part of regular forces but that fight for and on behalf of states wishing 
to alter the strategic outcome of a conflict while remaining external to it. The proxy is 
indirectly embedded with the external state in as much as it becomes their conduit of armed 
violence on the basis of the state’s provision of a range of support.”!93 In this thesis, the 
author considers a proxy as a group with a grievance against another group, so its interests 
align with the state sponsor. Therefore, the proxies can be ideologically supportive of the 
sponsoring state, but the main reason for involvement in struggle or conflict is not for 
financial profit, as affiliates, or for ideology, as auxiliaries, but for their own interests. In 


the case of the Ukrainian crises, proxies are used in eastern Ukraine, where the aim was to 
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create a frozen conflict, as opposed to Crimea, which was occupied and merged into 
Russia.!94 The proxy forces’ role has turned out to be not just military as it was with the 


auxiliaries in the Crimea, but a much larger political and strategic one.!95 


d. Organized Crime 


The relationship between the Russian state’s highest echelons and organized crime 
is very different from the West.!9© Organized crime is used both overtly and covertly to 
realize Moscow’s foreign policy goals abroad.!97 In Europe, organized crime groups 
linked with Russia “have been used for a variety of purposes, including as sources of “black 
cash,” to launch cyber-attacks, to traffic people and goods, and even to carry out targeted 


assassinations on behalf of the Kremlin.” !98 


Criminal networks perform even the duties typically considered as government 
functions, such as intelligence operations and political influence.!9? For example, despite 
having similar criminal roots to their Western counterparts such as Hells Angels MC and 
Bandidos MC, the Russian Night Wolves Motorcycle Club (NWMC) has become a 
Russian state tool uniting battle-ready diasporas abroad.200 The NWMC closely cooperates 
with the Russian military and uses its corporate entity to spread propaganda and provide 


military-style training to countrymen living outside Russia.2°! The NWMC is represented 


[94 Rauta, 10. 


195 Viadimir Rauta, “Proxy Agents, Auxiliary Forces, and Sovereign Defection: Assessing the 
Outcomes of Using Non-State Actors in Civil Conflicts,” Southeast European and Black Sea Studies 16, 
no. 1 (2016): 104-105, https://doi.org/10.1080/14683857.2016.1148416. 


196 Kira Harris, “Russia’s Fifth Column: The Influence of the Night Wolves Motorcycle Club,” 
Studies in Conflict & Terrorism 43, no. 4 (2020): 259, https://doi.org/10.1080/1057610X.2018.1455373. 


197 Mark Galeotti, Crimintern: How the Kremlin Uses Russia’s Criminal Networks in Europe, Policy 
Brief No. 208 (London, UK: European Council on Foreign Relations, 2017), https://www.ecfr.eu/ 
publications/summary/crimintern_how_the_kremlin_uses_russias_criminal_networks_in_europe; Harris, 
“Russia’s Fifth Column: The Influence of the Night Wolves Motorcycle Club,” 259. 





198 Galeotti, Crimintern: How the Kremlin Uses Russia’s Criminal Networks in Europe. 
199 Galeotti. 

200 Harris, “Russia’s Fifth Column,” 259. 

201 Harris, 259. 


36 


in Russia, Ukraine, Belarus, Latvia, Serbia, Macedonia, Romania, Bulgaria, and 


Germany .202 


Domestically, Russian authorities are fighting against militant nationalists, but they 
support, both overtly and covertly, radical right-wing organizations in several European 
countries and North America.293 This gives Russia the opportunity, through local anti- 
regime groups, to undermine its opponents and put these right-wing networks in a position 
where they can be used to spread propaganda and later, if necessary, carry out destructive 
subversion.294 Russian intelligence agencies routinely use the criminal underworld to 
perform their tasks and use these networks both in the cases of unarmed and in more violent 
situations,295 and this applies especially in Ukraine, where the criminals are acting not only 


as collaborators but also as combatants.296 
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Hl. ESTONIA 


A. INTRODUCTION 


This chapter is a case study of Estonia, a small post-Soviet country in Eastern 
Europe. After the collapse of the Soviet Union in 1991 Estonia became independent and a 
part of Western society. It has been a member of NATO since March 2004 and of the EU 
since May of the same year.297 Estonia is one of the three Baltic states located in the so- 
called near-abroad of the Russian Federation. Russia continues to be interested in 


influencing the processes taking place in Estonia and its relations with Western partners.20° 


The second section of this chapter introduces the reader to Estonia’s geographical 
location and briefly describes the state structure and the economic situation. This is 
followed by a description of Estonia’s historical ties with Russia, as they continue to 
influence events in Estonia. The most influential and clearest Russian NTW campaign 
against Estonia to date was the 2007 Bronze Soldier riots. To understand the reasons for 
the unrest and the evolution of events in 2007, it is essential to describe the historical 
relations of Estonia and its population with the Russian Federation, and the differences of 


opinion in interpreting the history of Estonia. 


The third section describes the Bronze Soldier events in April 2007 and the first- 
ever anti-state cyber-attacks from April to May. First, the section describes the immediate 
circumstances and environment that led to the unrest in Estonian society. This is followed 
by a description of the events, which were street riots lasting three to four days and cyber- 
attacks against Estonia that started simultaneously but lasted for three weeks. There is also 
a description of the Estonian embassy’s besiegement, which happened in Moscow and 


lasted for a week simultaneously with the street riots and cyber-attacks. This activity was 
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a severe violation of international diplomatic rules and was part of the political pressure in 


Russia’s attack on Estonia. 


The fourth section analyzes which non-state actors, previously described in Chapter 
II, Russia used in the Bronze Soldier affair. Following the example of Chapter II, the 
analysis is divided into parts based on the actors. First, the actor-based analysis shows their 
activities before and in 2007, how they were connected to the Russian government or its 
state actors, and the consequences of those activities. In the same actor-based parts, the 
author then examines how Russia has tried to use these non-state actors in Estonia and 


against Estonia after 2007. 


The last section of the chapter summarizes the use of non-state actors and concludes 
that Russia’s actions against Estonia in 2007 were ultimately a failure, but nevertheless, it 
continues its activities against Estonia with similar approaches. The section suggests why 
the Bronze Soldier case did not evolve into a statewide long-term crisis and which actors 
Russia continues to prepare and possibly plans to use if new NTW campaigns should occur 


in Estonia again. 


B. ESTONIA’S GEOGRAPHICAL LOCATION AND POPULATION, STATE 
STRUCTURE, AND ECONOMY 


The Republic of Estonia, a small Eastern European country that borders the Baltic 
Sea and the Gulf of Finland, is located between Latvia and the Russian Federation.29 
Together with the Latvian and the Lithuanian Republics, it forms the Baltic states. 
Estonia’s closest neighbors are also the Republic of Finland, approximately 80 kilometers 
(50 miles) north across the Gulf of Finland, and the Kingdom of Sweden, about 400 
kilometers (250 miles) northwest across the Baltic Sea. Estonia has a population of just 


over 1.3 million people, 68 percent of whom are Estonians, 25 percent Russians, 6 percent 
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other nationalities such as Ukrainians, Belarusians, and Finns, and about | percent of the 


population is of unknown origin.2!0 


Estonia is a parliamentary republic. The Riigikogu (Parliament) is the Estonian 
people’s representative body, which, according to the Constitution, has legislative 
power.2!! A prime minister appointed by the president and approved by the Riigikogu 
heads its government.?!2 The prime minister is responsible for exercising the executive 
power given to the government, but the head of state is the president, elected by the 


Riigikogu or the electoral body for five years.2!3 


The most important sectors of the Estonian economy are wholesale and retail trade, 
transport, accommodation and food service activities, industry and public administration, 
national defense, education and health, and social work.2!4 Intra-EU trade accounts for 68 
percent of Estonia’s exports, while outside the EU, 6 percent goes to both the United States 
and Russia. Seventy-seven percent of imports come from EU member states; while outside 
the EU, 9 percent comes from Russia and 4 percent from China.2!>5 The fact that 
approximately three quarters of trade is conducted within the EU and with the United States 


shows that Estonia is fully integrated into Europe and Western community. 


C. HISTORICAL FACTORS THAT CREATED THE PRECONDITIONS 
FOR THE BRONZE SOLDIER INCIDENT 


Historically, Estonia has been a battleground for neighboring and larger countries. 
After being ruled successively for centuries by Denmark, Sweden, and Germany, Estonia 


was part of the Russian Empire for nearly two centuries.2!© This rule was followed by a 
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year of the German Empire’s occupation, after which Estonia attained de facto 
independence at the end of the First World War.2!7 From 1918 to 1920, Estonian defense 
forces, in the War of Independence, faced the invading Red Army that was followed by 
German troops posted in Latvia.2!8 Estonia lost more than six thousand soldiers in the War 
of Independence, but won the war after concluding the Tartu Peace Treaty. Despite a 
Soviet-backed coup attempt in 1924, Estonia maintained its freedom until 1940.2!9 That 
attempt began in the early morning of December 1, 1924, when strike groups sent from the 
Soviet Union, together with underground Estonian communists, attempted to overthrow 
the Estonian government, seize power, and then call in the regular Red Army troops for 
help.229 The aim was to establish a communist regime in Estonia and to unite it with the 
Soviet Union, but the Estonian government declared a state of war and the coup attempt 


was suppressed on the same day.?2! 


In the twentieth century, Estonia found itself at the crossroads of power struggles 
between great powers. The Molotov-Ribbentrop Pact, signed in August 1939 by Hitler and 
Stalin, resulted in Eastern Europe’s distribution between the Soviet Union and Nazi 
Germany. Consequently, Estonia lost its independence once more and was forcibly 
incorporated into the Soviet Union in 1940.22? The following year, 1941, the Soviet Union 
started mass deportations (there were more to follow in 1949), and more than ten thousand 


Estonians—from a total population of 1.1 million—were taken to Siberian death camps 
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where the majority either perished or were executed.223 In the vision of the Soviet 
leadership, the future front line had to be cleansed of a “socially foreign element,” though 
no one was convicted in court; merely a presumption of anti-regime sentiment was enough 


to be deported.224 


During the Second World War, the occupying forces changed on Estonia’s territory 
from Soviets to Nazis, and in this time frame, both mobilized in total about a hundred 
thousand Estonians out of a 1.1 million population into their troops.225 About one-third 
ended up fighting for the Soviet forces and two-thirds fighting for the Germans.22© The 
fact that a number of Estonians fought on the German side is used as a tool for 


contemporary Russian propaganda to label Estonians either Nazis or Fascists. 


About a year before the end of the war, in September 1944, when German troops 
were forced to withdraw from Estonian territory, Estonia tried once again to regain its 
independence.22/ In accordance with the pre-war 1937 Constitution, a new government 
was quickly convened, and the Estonian national flag was hoisted on the roof of the pre- 
war parliament building in the capital, Tallinn.228 A few days later, a new wave of Red 
Army troops arrived in the capital, replaced the Estonian flag with the Soviet Union’s and 
arrested the new government’s representatives.22? With this, Estonia was conclusively 
incorporated into the Soviet Union. After that, Soviet authorities and troops remained in 


Estonia for the next fifty years.239 Estonians did not readily submit to the new Soviet order. 
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A national resistance movement emerged among the people, the Forest Brotherhood, which 


sought not to allow the Soviet leadership to impose power freely. 


At the end of March 1949, the Soviet authorities began another deportation 
operation, during which more than twenty thousand people were deported from Estonia to 
Siberia.23! Its primary aim was to complete the collectivization that had begun in 1947, 
which had not succeeded through economic pressure alone.232 The main culprits were 
considered to be better-off farmers and their families, who did not want to join the 
collective farm or give up land, livestock, and inventory owned within the family for 
several generations.?33 Secondly, the aim was to suppress the Forest Brotherhood, which 
supported many people’s hopes and beliefs that Soviet power in Estonia would soon run 
out.234 As a result of wars and two mass deportations in 1941 and 1949, Estonia had lost a 


significant part of its population. 


From the beginning of the 1950s, many non-Estonians from other Soviet territories, 
such as Pskov, St. Petersburg, Novgorod Oblast, and Central Russia, began to arrive or 
were resettled by the Soviet authorities in Estonia.235 During the Khrushchev era, the 
Soviet regime released the deported Estonians from “special residence” in Siberia.236 In 
total, of those deported in 1949, about 15 percent perished.237 As a result of these changes, 


the ratio and importance of Estonians in their “Sovietized” homeland decreased.238 The 
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1989 census showed that nearly 26 percent of the Estonian population had been born 


outside Estonia, one of Europe’s largest figures at the time.?39 


A few years before the collapse of the Soviet Union in 1991, peaceful anti-Soviet 
and pro-independence movements began to emerge in the Baltics. These culminated in 
1989 with the forming of a 600-kilometer (372 miles) human chain from Tallinn, the capital 
of Estonia, through the Latvian capital of Riga to Vilnius, the Lithuanian capital.249 This 
event marked the Molotov—Ribbentrop Pact’s fiftieth anniversary and attempted to draw 
attention to the Baltic states’ fate.24! Estonia, together with other Baltic states, regained its 
independence in 1991 with the break-up of the Soviet Union, but the withdrawal of troops 
took a few more years, and the last Russian units left Estonia in 1994.242 The most 
important events of the twentieth century that influenced Estonia’s independence, people, 


and statehood are illustrated in Figure 1. 
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Figure 1. The events that most affected Estonia in the twentieth century.243 


if The Historical Memory of Estonia and Russia 


Estonia and Russia disagree on the Soviet history of the 1940-41 and 1944-91 
periods in Estonia.244 The Russian Federation sees its actions during these periods, or at 
least officially interprets them, as liberation, while the Estonian side is firmly convinced 
that the Soviet Union occupied the country.245 At the international level, the European 
Court of Human Rights stated in 2006 that, “After the German occupation in 1941-44, 
Estonia remained occupied by the Soviet Union until the restoration of its independence in 
1991.”246 “Soviet rule brought with it three important things that are still vividly 


remembered in Estonia: mass repressions, poverty and changes in the country’s ethnic 
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composition.”247 Almost a quarter of Estonia’s population today is of Russian nationality. 
The majority of them are ordinary and peaceful residents, whose goal is not to undermine 
or work against the country. At the same time, there is no consensus among ordinary 


Estonians and Estonian-Russians in Estonia regarding historical events.248 


2. Estonian Citizenship Issues after Restoration of Independence 


The case of the Bronze Soldier in 2007 concerned not only the interpretation of 
history but also the question of how some Russian speakers perceive their place or status 


in Estonian society. 


Estonia sees its independence not as secession from the Soviet Union but as a 
restoration of the former pre-Soviet state.249 Therefore, after independence was restored, 
Estonian citizenship was automatically granted to those who had been Estonian citizens 
before the country was incorporated into the Soviet Union and to their descendants as 
well.259 By contrast, immigrants to Estonia during the Soviet period and their descendants 
were required to undergo a naturalization process in order to secure Estonian 


citizenship.2>! 


As it stands, an applicant for citizenship must have at least eight years of legal 
residency in Estonia, including five as a permanent resident.2>2 The person also must show 
proof of consistent lawful income, complete written and oral language exams, pass an 
Estonian constitutional competency exam, and give an oath of state allegiance.253 In 


general, non-citizens living in Estonia enjoy the same rights and free access to social 
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protections as citizens but they cannot vote in Estonian or the EU elections unless they are 
EU citizens.254 They also are restricted from becoming a political party member, working 


in the local public sector, or holding public office.2>5 


The issue of citizenship has been topical and tense since Estonia regained its 
independence. It is an issue that can be debated from different perspectives and bent to suit 
one’s particular goals. It is most often discussed in the context of ethnic Russians in 
Estonia, but the citizenship policy applies equally to people of all nationalities who wish 
to become Estonian citizens. It has not been developed separately for Russians living in 
Estonia. The cornerstone of the sustainability of Estonia as a small nation is the 
preservation of its language and identity. Therefore, language proficiency is an essential 


condition for becoming a citizen. 


While Estonia’s citizenship policy is similar to those of other states—and compared 
to the other EU countries, the naturalization requirements in Estonia are relatively liberal— 
it has created controversy and resentment.256 Estonia’s citizenship policy and its impact 
on Russian speakers continue to be a challenge for the country.2>’ The policy creates a 
wedge between Estonians and Russian speakers, reinforcing a “‘one state-two societies” 
system.298 The Russian government, as well as several international institutions such as 
the Organization for Security and Cooperation in Europe and Human Rights Watch, has 
characterized Estonian citizenship policy as marginalizing or discriminatory.25? Estonian 
citizenship policy as it stands has led Russian nationalists and the Russian government to 


regularly accuse the Estonian state of violating civil rights. 
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D. THE BRONZE NIGHTS RIOTS IN 2007 


The best-known case in recent history that involved the Russian Federation’s use 
of non-state actors against Estonia is the so-called Bronze Soldier events of 2007. On April 
26-29, 2007, riots took place in Tallinn and, to a lesser extent, in four towns of eastern 
Estonia.2©9 Russian-speaking people started to violently protest against the government’s 
decision to relocate the Second World War soldier-liberator statue and the anonymous 
Soviet soldiers buried in adjacent war graves from the center of the capital to the Estonian 


Defense Forces Cemetery.26! 


Simultaneously, Estonia was hit by cyber-attacks of Russian origin that occurred in 
two waves over three weeks, from April 27 to May 18.22 This was the first time in history 
where the country had been the subject of cyber-attacks originating from another country 
that influenced its government, banks, media, and political parties.23 The events in Estonia 
in 2007 were notable because the Russian Federation exploited the Russian-speaking 
diaspora in an EU- and NATO-member state to amplify internal tensions and combined 
the mobilization of this diaspora with other irregular techniques in the same campaign. 
Juurvee and Mattiisen conclude that, “the use of hybrid means was almost absent from 
Russia’s public doctrinal and policy documents until 2007 when the Bronze Soldier crisis 


occurred in Estonia.”264 


1. Events Leading Up to the Bronze Soldier Incident 


According to the Estonian Internal Security Service (EISS), in 2004, Russia’s 


special services prepared an analytical report that provided a review of several of Russia’s 
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foreign policy directions connected with the enlargement of the EU and NATO. 
According to the study, Russia had to continue its argumentative and offensive position 
towards the Baltics to prevent the emergence of anti-Russian sentiments and to ensure the 
rise of Russia’s foreign policy authority in the world.2° The most crucial factor was the 


need to better protect Russia’s interests in the “near abroad.”267 


In Estonia, the Russian community and its leaders were directed and financially 
supported both directly from Moscow and through the Russian embassy in Estonia.268 A 
few years prior to 2007, a growing number of Estonian-Russians, following the example 
of the Red Army veterans in Estonia, began celebrating holidays commemorating Soviet 
military victories more and more actively in Estonia, provoking the non-Russian Estonian 


public.269 


These holidays included the May 9 anniversary of the USSR’s victory in the Great 
Patriotic War—the name given to the Second World War in the former Soviet Union and 
modern Russia. Estonian-Russians annually commemorated this victory by raising the 
Soviet and Russian flags and military symbols next to the Bronze Soldier statue in 
Tallinn.279 A similar event took also place every year on September 22, when the 
anniversary of the so-called Soviet liberation of Tallinn was celebrated.27! These 
commemorations represented a fundamental confrontation of values between Estonians 


and Estonian Russian-speakers. 
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The Bronze Soldier location was increasingly becoming not a memorial to the 
fallen but a symbolic place to express pro-Russian opinions that were completely at odds 
with Estonian government policy and the meaning of the Second World War for 
independent Estonia as a whole.272 The continuation of Russia’s propagandistic behavior 
and the influence of officials, representatives of organizations, and the media intensified 
extremists’ activities in Estonia; consequently, supporters and opponents of the Bronze 


Soldier emerged, and contradictions and conflicts between various parties intensified.273 


A series of events preceding the 2007 riots took place a year prior. On May 9, 
2006—sixty-one years after the end of the Second World War—an individual took the 
Estonian flag and an anti-Soviet poster to the Bronze Soldier’s location. The poster read, 
“This soldier occupied our country and deported our people!”274 At the monument, people 
celebrating with Soviet and Russian symbols attacked the Estonian flag and its carrier in 
front of television cameras, and the police had to take him away. The fact that the Estonian 
flag was removed while the Soviet flags and symbols remained at the scene broadened 
tensions in society.27> A few days later an Estonian nationalist publicly declared that he 
would blow up the statue if it remained in its location. This was followed by a public 
meeting demanding that the Bronze Soldier monument be removed.27© The day after the 
meeting, the statue was defiled with paint, prompting Russian-speaking activists in Estonia 


to form a Night Watch organization to “protect” the statue.277 


2. The Street Riots 


The increase in tensions in society and the fact that the monument had become an 


influential political issue by that time led the Estonian government to decide that the Soviet 
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war graves and the monument in the city center had to be relocated. The government 
decided that the Estonian Defense Forces military cemetery in Tallinn was a more 
appropriate place for the monument and memorial to the Red Army soldiers who fell in the 


Second World War.278 On April 18, 2007, the Estonian Ministry of Defense announced 


the start of excavation work at the Bronze Soldier’s site.279 


About a week later, on April 26, 2007, as preparations for the identification of war 
graves started, crowds began to gather at the Bronze Soldier’s site, mostly Russian- 
speaking and among them some Night Watch activists.280 The Russian media was 
present and Dmitriy Linter, the leader of the Night Watch movement, gave an interview to 
the Russian television channel. Linter, who later turned out to be one of the organizers of 
the coming unrest, told Russian TV that a civil war was about to begin in Estonia and 
suggested that the world would soon see an entirely different Estonia with changed 


rulers.281 


On the evening of the same day, the first attacks against the police by the crowd 
quickly gained momentum, and police forces soon had to start pushing violent masses away 
from the Bronze Soldier’s site.282 The crowd, which consisted of young Russian-speaking 
groups periodically shouting “Rossiya” [Russia], was diverted away, where it began the 
looting, destruction, and partial arson of streets, shops, and businesses in the center of 
Tallinn.283 As a result of the unrest that night, a Russian citizen living in Estonia was 


stabbed to death in a crowd, and a number of people were injured, including police 
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officers.284 The killing of the Russian citizen was followed by fierce Russian propaganda 
and a series of fake news reports that tried to discredit the Estonian authorities and 
investigative institutions.28> For example, President Putin, upon learning of the incident, 
said, “The point is not that there was an accident. We are worried about something else: 
that the person was not helped when he was wounded,” and later declared that the Russian 
was dying in front of the Estonian police, and it was a “deliberate crime.”28 The Russian 
news agency ITAR-TASS published fake news, claiming that, “the police beat him with 
truncheons, he was then dragged bleeding to the side where he was handcuffed to the post. 
Dmitri lost consciousness and did not return.”287 There is no official number for the size 
of the crowd in Tallinn on the evening of April 26, but most media reports estimated the 


number of rioters at 1,500.288 


Due to the rapid escalation of the situation, the government’s crisis committee 
decided to quickly remove the Bronze Soldier statue from its location in the early morning 
of April 27.289 Nevertheless, the unrest continued in the following two to three days both 
in Tallinn and, to a lesser extent, in eastern Estonia, which is inhabited mainly by Russian- 


speakers in four smaller towns.299 


284 ERR, “Chronology of the Bronze Soldier Conflict”; Mihkel Karmas, “Ganinite Advokaadi S6nul 
Kasutab Venemaa Juhtumit Poliitilistel Eesmérkidel” [According to Ganins’ Lawyer, Russia Is Using the 
Case for Political Purposes], ERR, April 19, 2017, https://www.err.ee/590769/ganinite-advokaadi-sonul- 
kasutab-venemaa-juhtumit-poltitilistel-eesmarkidel. 


285 Kiarmas, “ According to Ganins’ Lawyer, Russia Is Using the Case for Political Purposes.” 


286 “B 3croHun e0 06 yOuilicTBe poccnanuna J[mMutpusa Danna BbIesIeHO B OTAC/IbHOe 
mpou3BoycTBo” [In Estonia, the case of the murder of the Russian Dmitry Ganin has been separated for 
separate proceedings], Newsru, November 20, 2008, https://www.newsru.com/world/20Nov2008/ 
ganin.html. 


287 “B Tanne pa3pe3aH H BbIBe3eH M10 YaCTAM NaMATHHK Bonny-ocBobogsntemo. B OecnopayKax 
yOuT pyccKos3bI4HbI %*KuTeN” [In Tallinn, a monument to the Liberator Soldier was cut and removed in 
parts. Russian-speaking resident was killed in riots], Newsru, April 27, 2007, https://www.newsru.com/ 
world/27apr2007/tallin.html. 


288 Lepik, “The Leaders of the Bronze Night Disappeared to Russia’; “Fotod: T6nismaéel Meenutati 
Pronksi6é6d” [Photos: Bronze Nights were remembered on T6nismée], ERR, April 26, 2018, 
https://www.err.ee/82663 1/fotod-tonismael-meenutati-pronksiood; “Meenuta, Kus Olid Sina 5 Aastat 
Tagasi Pronksi66 Ajal?” [Remember where you were 5 years ago during Bronze Night?], Delfi, April 25, 
2012, https://m.delfi.ee/rahvahaal/article.php?id=64307687. 


289 Juurvee and Mattiisen, The Bronze Soldier Crisis of 2007, 21. 
290 ERR, “Chronology of the Bronze Soldier Conflict.” 


53 


In total, a thousand people who took part in the unrest in Tallinn and eastern Estonia 
from April 26 to 29 were detained.29! Four people were charged with organizing the riots: 
three Night Watch activists—Dmitriy Linter, Maksim Reva, and Estonian journalist and 
politician Dimitriy Klenskiy—and the leader of the Russian youth organization Nashi in 


Estonia, Mark Siryk.292 


3. The Cyberattacks in the Bronze Soldier Incidents 


On April 27, the day after the start of the street riots, Estonia was hit by two waves 
of cyber-attacks that lasted for about three weeks, until May 18. These cyber-attacks aimed 
to overload Estonia’s computer and network servers with excessive volumes of message 


traffic, causing them to collapse.293 


In the first wave, from April 27 to 29, Russian “autonomous” hackers incited fellow 
nationalistically or politically motivated individuals on social media, Russian-language 
Internet forums and websites to carry out attacks against Estonian websites.294 These 
hackers granted online access to the necessary applications and specific directions that 
people could effortlessly download and use as “cyberweapons.”2°> As a critical mass could 


not be mobilized, these attacks did not cause significant damage.?9© 


The second stage of web activities from April 30 to May 18, in contrast, had 
characteristics of central command and control.297 The second wave of cyber-attacks 


included “the denial of service (DoS) and distributed denial of service (DDoS) attacks, 
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defacement of websites, and large amounts of comment and email spam.’”298 Internet 
forums disseminated propaganda to incite cyber-attacks and instructions aimed at directing 
and supporting networked cyber-attacks.29? The targets of the second wave of cyber- 
attacks were: |. Servers of organizations accountable for the Estonian Internet framework; 
2. Governmental and political institutions such as Parliament, the president, different 
ministries, state agencies, and political parties; 3. Services provided by the private sector, 


such as e-banking, news organizations; 4. Private and random targets.300 


By 2007, 98 percent of Estonian territory was covered with Internet access, and 
cellular phone coverage was close to 100 percent.39! Also, Estonia’s information systems 
and databases had, by that time, been developed into a universal national information 
system with a corresponding functional foundation that allows customers to access services 
on a “one stop shopping” basis.302 This means that many of the day-to-day services used 


by businesses and ordinary people were centralized in a single system or location. 


The cyber-attacks affected and interrupted the Estonian internal economic sectors 
that mainly rely on information and communications technology and electronic 
communications in their everyday business, such as media, banking, and small and 
medium-sized businesses.393 It also hindered access to communications with public 
administration information flow to the outside world, blocking parts of the benign web 
traffic as well as that for malicious uses.394 These Russian-linked cyber-attacks on Estonia 
targeted the whole public and the economic base of the country, intending to paralyze a 


nation that significantly relies on digital networks. 
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4. Blockade of the Estonian Embassy in Moscow 


From April 27 to May 5, the Estonian embassy in the Russian capital, Moscow, 
was blockaded by members of Nashi and another Russian youth organization, Molodaya 
Rossiya.395 About six hundred people besieged the embassy continuously.30© They 
obstructed embassy staff and the movement of diplomats, both Estonian and other 
nationals; threw stones and paint at the building, causing material damage; and disrupted 
the embassy’s work by constantly playing loud music from speakers.397 Also, the 
protesters wrote offensive and provocative messages on the embassy walls, such as, “We 


arrived in Berlin; we also reach Tallinn.”’398 


On May 1, four activists managed to get through the barriers protecting the 
embassy, who then tore down the Estonian flag from the embassy and shredded it to 
pieces.399 During the Estonian flag’s defilement, a delegation of the Russian duma visiting 
Estonia declared to the officials of the Estonian Ministry of Foreign Affairs that Moscow’s 
situation could be normalized in three minutes if the Russian side only wanted it.3!9 On 
May 2, a Nashi activist attacked Estonian ambassador Marina Kaljurand with pepper spray 
at a press conference in the offices of the Moscow city government’s weekly newspaper. 


Simultaneously, the protestors also attacked the ambassador’s car as it stood in front of the 
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building and tore off the Estonian flag.3!! After the press conference, the ambassador’s car 
was caught in an ambush when two vehicles blocked the road and Nashi activists 
surrounded her car, demanding that she leave the country.3!2 In a telephone conversation 
with his German counterpart Frank-Walter Steinmeier, Russian Foreign Minister Sergei 
Lavrov promised that the Russian government would ensure that police forces ended the 
embassy’s blockade, provided that the Estonian ambassador left Moscow.?!3 The Estonian 
ambassador left Moscow on April 3 or 4 and returned to Estonia on a so-called official 
holiday. After that, the protesters announced this as their victory in a newspaper interview 
entitled, “Marina Kaljurand, the ambassador of the fascist state, was given two options — 


apologize or leave the country. She chose the latter.”3!4 


E. RUSSIA’S AIMS, INFLUENCE CAMPAIGNS, AND USE OF NON-STATE 
ACTORS IN ESTONIA 


How is Russia operating against Estonia? 


1. Russia’s Aims in Estonia 


Russia does not have a great strategy other than to weaken the West, its alliances, 
and organizations and create a more favorable environment for spreading influence and 
pursuing its foreign policy goals.3!5 Moscow implements so-called active measures— 
ways and means to influence the course of events in the target country or region to change 


the target area’s policy toward Russia to a more favorable one—in Europe just to create 
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instability and confusion.3!6 Russia’s actions are mainly opportunistic and shaped by local 
circumstances.3!7 The Bronze Soldier incident presented Russia’s opportunism in using 
favorable conditions to weaken its opponents, “if an opportunity arises to destabilize a 
country Russia considers an adversary, including NATO countries, there is a high 


probability that it will be exploited.”318 


Also, Russia lacks a central understanding and management or control structure to 
realize state interests outside Russia, and various interest groups in the state system are 
often acting independently based on separate interests, needs, and logic.3!9 Kadri Liik, a 
senior expert of the European Council on Foreign Relations, cites the example of the 
constant deterioration in relations between Russia and Germany, one of the main reasons 
for which is the uncoordinated actions of various Russian system interest groups in 
Germany.229 Such examples include the hacking of the German federal parliament in 2015; 
the “Lisa case,” a disinformation campaign about a Russian-German girl allegedly raped 
by immigrants, in 2016; the murder of Georgian national Zelimkhan Khangoshvili in 
Tiergarten in 2019; and the poisoning of Alexey Navalny, hospitalized in Germany in 


2021.32! 


Russia and its intelligence agencies took advantage of the tensions between 
Estonians and many Russian-speakers living in Estonia, such as the interpretation of history 
and citizenship issues that create a “one state-two societies” situation. For the Russians in 


Estonia, this monument and location symbolized mainly liberation. But for the Estonians, 
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it reminded them of almost half a century of occupation that brought with it mass 
deportations, poverty, and change in ethnic composition.322 According to their own words, 
many stateless Russian-speaking Estonian residents feel like second-class members of 
society.323 These differences were exploited until the crisis finally erupted, the aim of 
which was to paralyze the work of institutions ensuring security and state functions and to 


discredit the Estonian government. 


Russian intelligence’s failure to prepare a capable local command and organized 
groups of auxiliary forces in Estonia for the Bronze Soldier conflict shows Russia’s 
opportunism in using the favorable occasion to weaken Estonia. Due to the rapid 
development of events before the crisis, the intelligence services did not have enough time 
to prepare. For starters, Lieutenant Colonel Andrey Lobanov of the FSB St. Petersburg 
Central Administrative Board failed to recruit suitable agents or collaborators at the 
beginning of 2007 in Estonia, in nearly the last moments before the unrest.324 Probably as 
a result, ordinary Russian diplomats residing in Estonia were forced to guide and advise 
future organizers of turmoil at a time of rising tensions.325 At the time of the unrest, 
Russian intelligence’s role was to monitor developments and progress of the events326 
because responsibility had been given to previously instructed local collaborators— 
Dmitriy Linter, Maksim Reva, and Mark Siryk—who organized the uprising and tried to 
lead it directly.327 This approach suggests that the evolving course of events was unfamiliar 
to Russian intelligence as well. Their later modus operandi, which was more successfully 
used in Georgia and Ukraine, was still in the developing stage in Estonia in 2007 and 


needed real-time testing. 


322 Juurvee and Mattiisen, The Bronze Soldier Crisis of 2007, IV. 
323 Vetik, “Citizenship, Statelessness and Belonging in Estonia,” 7. 
324 Estonian Internal Security Service, Estonian Internal Security Service Review2007, 11. 


325 Rasmus Kagge, “Aarmuslaste Aktsioonide Tagant Paistab Vene Diplomaatide Vari” [The Shadow 
of Russian Diplomats Is behind the Actions of Extremists], Postimees, April 25, 2007, 
https://www.postimees.ee/1653973/aarmuslaste-aktsioonide-tagant-paistab-vene-diplomaatide-vari; 
Estonian Internal Security Service, 9. 


326 Estonian Internal Security Service, 9. 


327 Juurvee and Mattiisen, The Bronze Soldier Crisis of 2007, 19-24. 
59 


Zs Media Influence before, during and after the Bronze Soldier Events 


One of the main channels for implementing Russia’s active measures towards 
Estonia is the media. A greater and more influential part of the Russian media is under the 
Russian central government’s direct control.328 Before and during the Bronze Soldier 
events, Russian-speakers in Estonia mainly consumed Russian media content or Russian- 
language programs created especially for Estonian and the Baltics’ Russian audiences.329 
In their report Russia’s Hostile Measures: Combating Russian Gray Zone Aggression 
Against NATO in the Contact, Blunt, and Surge Layers of Competition, Stephanie Pezard, 
Katya Migacheva, and Brenna Allen list popular television channels, which Estonia’s 
Russian audience mainly follow. These include “PBK, a subsidiary of the Russian-owned 
BMA media conglomerate, which rebroadcasts Russian media in the Baltics; the state- 
owned RTR-Planeta, which broadcasts globally; NTV, which is owned by Gazprom; and 
the Russian government—controlled RT, formerly Russia Today, whose multilingual 
broadcasting has been the target of propaganda accusations in several countries, including 
the United States.”339 According to the authors, “The majority of Russian media in both 
Russia and Estonia has toed the Russian government’s official line arguing that Estonia 
misrepresented history in service of its goals, was experiencing a fascist revival, and put 


Russian speakers in Estonia at risk of persecution, repression, and discrimination.”33! 


Russia’s attempts to divide and influence Estonian society through information 
operations and propaganda did not end in 2007. Russia’s influence activities continue 


according to a similar pattern that led to the Bronze Soldier conflict. 
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The purpose of the media controlled by the Russian central government is not to 
truly reflect the world events but to deal with Russia’s image building and fulfill the 
country’s domestic and foreign policy goals.332 Russian media channels regularly send 
both print journalists and television crews to Estonia, who do not engage in journalistic 


work but organize productions according to a given scenario.>33 


There appear to be three primary aims of Russian propaganda and information 
operations in Estonia. First, to show that after the secession from the Soviet Union, Estonia 
has become an economically, socially, and culturally degenerate society on the European 
periphery, in which the anti-Russian Estonian government is accused.334 Second, to create 
tense relations between the natives and the Russian-speaking community, Russia’s 
disinformation operations aim to sow distrust of the Estonian state and show Russia as a 
defender of Russian-speakers’ interests.53> Third, Russia wants to create the image of 
Estonia as an undemocratic and problematic partner for NATO and the EU to weaken 
relations with Estonia’s allies and reduce its international clout in influencing Russia’s 


policy.336 


Several informational narratives and negative themes have been deployed by 
Russia, which are repeated continuously and are deliberately exploited.33’7 The main 


themes developed against Estonia are the following: 


e “Estonia is an undemocratic and pro-fascist state.” — For as long as 


Estonia has been independent, Russia has developed a narrative about 
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Estonia as an undemocratic country where national minorities are 
discriminated against, and fascism is rehabilitated. This topic is aimed at 


both the Western public and the Russian audience in both Russia and 


Estonia.738 
e “ETV+339 is a propaganda channel, and the Estonian government is 
waging an information war against Russia.” — An example of this 


narrative is the story ETV+ published in July 2016 on the Russian TV 
channel Rossiyal’s news program “Vesti.” The story emphasized how 
Estonia tries to exterminate everything that is Russian-like in the country. 
It was claimed that members of the Riigikogu (Estonian Parliament) are 
forbidden to communicate with Russian journalists in Estonia. 
Additionally, the news claimed that a Russian-language TV channel, 
ETV+, was created in Estonia to fight the incomprehensible so-called 


Russian propaganda.340 


e “The refugee crisis in Estonia.” — The exploitation of the European-wide 
refugee crisis in the Russian media has been active since September 2016. 
In this case, it is possible to observe the coexistence of two different 
narratives. First, “European governments cannot manage their refugee 
crisis and do not listen to their people’; therefore, “Europe has bad 
governments and good people.”34! An example concerning Estonia is the 
TV channel Rossiya’s news story about the anti-refugee demonstration in 


Tallinn.742 The background message of the story is that, “even Estonia’s 
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own people do not support their government.”343 Second, the parallel 
narrative is ““Estonians are racists.” This is an old theme, “Estonians are 
fascists,” but in the refugee-crisis framework, it has been modified to the 


theme “Estonians are racists.”344 


e “Discrimination against the Russian population is amplified in the refugee 
crisis.” — The so-called discrimination against the Russian population in 
Estonia became a sub-topic of the refugee crisis. This narrative took a new 
turn in several similar stories when rumors spread that Estonia would treat 
new migrants better than its Russian-speakers. The main message is that if 
“the Russians were previously second-class citizens, then when refugees 


arrive, they become third-class citizens.”345 


e In the field of politics, the topics of the “alleged mythical Russian threat” 
and “Russia’s so-called aggressive behavior” stand out more than others. 
These topics are mainly circulated in the leading Russian online 
portals.346 Estonia has been portrayed as a russophobic and about-to-be- 


extinct small country that is heavily militarized.347 


Media outlets and information channels that disseminate the propaganda narratives 
in Estonia are not operating independently. These are guided and commanded through 
high-level Russian authorities that often have links to the state’s intelligence and security 


agencies. 
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3. Russian Non-State Actors and State Actors that Lead and Direct 
Them 


Before and during the Bronze Soldier incidents, Yekaterina Zorina, a journalist 
from the Russian TV channel RTR, and Galina Sapozhnikova, a journalist from the 
Moscow newspaper Komsomolskaya Pravda, were used as direct malign influence tools 
against Estonia.348 These journalists coordinated their activities in Estonia, framed events, 
manipulated facts, and spread outright lies to discredit the Estonian state, government, 
authorities, and media.349 At the beginning of 2007, Zorina coordinated a plan with the 
leaders of the pro-Kremlin extremist youth movement Nashi to organize provocations at 
the location of the Bronze Soldier in Estonia.359 Also, Sapozhnikova called herself a 
disguised member of the Russian auxiliary group in Estonia Night Watch, established in 
2006, and attended that organization’s meetings before the riots.35! Moreover, 


Sapozhnikova actively continued anti-Estonian activities after 2007. 


Since 2007, Sapozhnikova has continued to write propaganda texts and opinion 
stories hostile to the Baltic states.3>2 She worked as a correspondent for Komsomolskaya 
Pravda in Estonia and led the Impressum chat club, which brought journalists, historians, 
and politicians critical of the West to Estonia.553 In 2013, Sapozhnikova compiled a list 
of “promising Estonian people” for the President of the Russian Federation 
Administration’s Directorate for Interregional Relations and Cultural Contacts with 
Foreign Countries (DIRCCEFC).354 There were nineteen names in this list, mainly Russian- 


speaking Estonian politicians and journalists.355 It is possible that these people were seen 





348 Kaitsepolitseiamet, Estonian Internal Security Service Review2007, 15. 
349 Kaitsepolitseiamet. 
350 Kaitsepolitseiamet. 
351 Kaitsepolitseiamet. 


352 Holger Roonemaa, “‘Perspektiivsed Eesti Inimesed’: Nimekiri Vene Valisluure Kindrali Laual” 
[“Promising Estonians”: A List on the Table of the Russian Foreign Intelligence General], Eesti Ekspress, 
November 24, 2020, https://ekspress.delfi.ee/kuum/perspektiivsed-eesti-inimesed-nimekiri-vene-valisluure- 
kindrali-laual?id=9 1760357. 


353 Roonemaa, “Promising Estonians.’” 
354 Roonemaa. 


355 Roonemaa. 


64 


as potential agents of influence through whom to gather information, to influence policy, 
and to communicate.>°® At the top of the list was the then deputy mayor of Tallinn and the 
current mayor, a member of the Estonian Center Party.357 The next three names also come 
from the Center Party.3>8 It is known that Russia actively uses its network of influencing 
agents to disrupt and influence European decision-making processes and is handled by the 
European-based coordinators.35? In August 2020, President Putin awarded her the title of 


meritorious journalist of the Russian Federation.369 


The DIRCCFC is a structural unit in the Administration of the President of the 
Russian Federation and was formed in February 2005.36! It is headed by the SVR General 
Vladimir Chernov, and the DIRCCFC reports directly to Anton Vaino, head of the 
Presidential Administration.362 In 2005, the EISS assessed that the directorate’s real goal 
is to consolidate the Russian diaspora in the neighboring states and influence Russian 
communities and other “near-abroad” residents in Moscow’s interests.363 The main task 
and goals of the DIRCCFC are to influence and control neighboring countries and achieve 


Russia’s foreign policy goals by non-military means.364 To achieve their goals, they can 
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involve Russian special services and intelligence agencies to procure and manage influence 


agents in post-Soviet countries.365 


One of the Russian propaganda methods is to keep suitable narratives in the 
spotlight through Kremlin-funded non-governmental organizations (NGO).3° The 
rhetoric that begins this way is promptly amplified by the Russian propaganda media and 
thus reaches the free media.7” There are many formerly independent organizations under 
the control of DIRCCFC management.768 One example is the Historical Memory 
Foundation (HMF), which appears to be operating independently, but documents and the 
correspondence leaked to the press indicate that the DIRCCFC coordinates HMF’s 


activities.369 


In 2018, HMF manager Aleksandr Dyukov delivered a report about the first ten 
years of the foundation’s activities to DIRCCFC.379 Dyukov portrays himself as a historian 
who is also related to the FSB—in reality, he lacks both a scientific degree and considerable 
professional achievements.37! The report highlights HMF’s five main lines of action: 
counteracting attempts to classify Soviet repression as genocide; discrediting the concept 
of the Holodomor famine in Soviet Ukraine in the 1930s; exposing and disseminating 


information on Baltic collaborators involved in Nazi crimes and the Holocaust; countering 
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the glorification of the Second World War Baltic freedom fighters, the Forest Brothers; 


and discrediting the interwar political regimes in the Baltic states.372 


Each line of action includes searching for documents in archives; preparing 
scientific publications, documentaries, and exhibitions; presenting the results in Russia and 
abroad; and organizing media campaigns.>/3 In line with these efforts, Dyukov was given 
unusual access to the FSB archives, which are normally closed to genuine historians and 
scholars.374 According to the report, the HMS has established a network of 124 foreign 
historians, politicians, and journalists.37> Five people from Estonia belong to the network, 
including one journalist, but their names have not been published.37© The HMF coordinates 


at least eleven non-profit organizations, which also help convey the necessary messages.377 


HMEF has aimed at the comprehensive discrediting and denigration of the resistance 
to the Soviet occupation.378 The Estonian resistance movement participants, the Forest 
Brotherhood, are portrayed as bloodthirsty bandits whose only motives were self-interest 
and revenge on the local population.37? In 2010, the HMF launched an online database, 
“Victims of Nationalist Terror in the Western Regions of the USSR” to discredit the Forest 


Brothers.389 


4. Cyber Operations 


While other malign and aggressive activities and events during the “Bronze Nights” 


were relatively predictable, at least in later analysis, the cyber-attacks made this combined 
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hybrid campaign different from previous conflicts. Estonian Ministry of Defense official 


Meelis Oidsalu has said, “The only thing that was not foreseen was the cyber-attacks.”381 


The exact purpose of the cyber-attacks in the Bronze Soldier case is not entirely 
clear.382 Rain Ottis, head of the Cyber Forensics and Cyber Security Center of Tallinn 
University of Technology, suggests that the cyber-attacks in the Bronze Soldier events 
were information operations where information and information technology were used to 
influence the opponent’s decisions and actions.783 In other words, their purpose was to 
create confusion among Estonian authorities and society and disrupt freedom of action and 


decision-making capacity. 


Ottis outlines three possible aims for cyber-attacks, which are likely to be 
interrelated. These are: 1. An attempt to unite the Russian diaspora against a so-called 
common enemy; 2. An attempt to destabilize the Estonian society and undermine the state’s 
economy to weaken its ties to the EU and NATO; 3. A proof of [Ottis’s developed] concept 
on the idea of a digital people’s war while supporting the overall political campaign 
surrounding the statue.384 According to Ottis, the concept of a people’s war in the context 
of cyber-attacks refers to the situation in which “ordinary citizens of a state can be 
motivated to use the resources under their control to independently attack enemy systems 


in order to confuse the defenders.”’385 


As with the precise aims of the attacks, despite the investigations, it has not been 
possible to establish that Russia, as a country, was behind the cyber-attacks.38© No entity 


has taken responsibility for organizing the attacks, and Russia has denied its involvement 
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in cyber-attacks against Estonia.387 Nevertheless, it is clear that the cyber-attacks were 
linked with Estonia and Russia’s overall political conflict.388 “The lack of cooperation in 
the Estonian investigation indicates that the Russian government is not interested in 
identifying the attackers and is therefore, in essence, protecting them. In other words, 
hostile rhetoric from the political elite motivated people to attack Estonia while nothing 
was done to stop the attacks. This silent consent, however, can be interpreted as implicit 
state support because without fear of retribution the attackers were free to target Estonian 


systems.”389 


Despite their massive size, the attacks were not complex; it is likely that the cyber- 
attacks were not carried out by Russian professional cyber units but mainly by so-called 
Russian patriotic hackers.399 These hackers organized and launched attacks and, as in street 
riots, involved like-minded and spontaneous participants. As described in the second 
chapter of this thesis, Russian patriotic hackers cooperate with Russian security agencies, 
such as the FSB. As cyber-attacks against an entire country were the first in history in 2007 
and therefore new to everyone, the FSB probably did not lead or task hackers but was aware 
of and conducive to their actions. It is also possible that the FSB took this first-time “cyber 
campaign” as a test in which hackers were given freedom of action and monitored for what 


kind of damage they could do to the target country.39! 


In the final analysis, however, the damage was surprisingly modest and 
temporary.392 Despite the attacks, in Estonia—where 97 percent of bank transactions are 


carried out online and 60 percent of the population uses the Internet every day—daily life 
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changes or interruptions were actually minor.393 Estonian journalist Kertu Ruus refers to 
Jim Lewis, a senior fellow at the Center for Strategic and International Studies in 
Washington, DC, who states that cyber-attacks on Estonia amounted to “blocking the 
highways and pounding on doors to make a political point.’”3% It is likely that the attackers 
also tried to test Estonia’s electronic defense capabilities for possible hostile activities in 


the future. 


5. Auxiliary Actors 


In 2006-2007, simultaneously with the information operations and the waves of 
propaganda, the so-called compatriot’s policy, used as a foreign policy tool of Russia, 
became more active.395 The idea of exploiting Russian-speakers abroad, called 
“compatriots” (sootechestvenniki), to pursue national interests had been familiar to the 
KGB since Soviet times.39© The Constitutional Party was a subversive project led by 
Russia, and an auxiliary organization of Russian special services in Estonia. This so-called 
party was, in fact, existed mainly on paper because because often it was not able to gather 
enough of its members to organize demonstrations, which is why the party claimed other 
social movements’ protests under its name.39” The Constitutional Party claimed publicly 
that it represented the Russian-speaking population in Estonia, but its central financial and 
ideological supporters were diplomats from the Russian embassy in Tallinn, various 
Moscow city government agencies, the Russian media, and different contact persons in the 
Russian special services.398 Andrei Zarenkov, the Constitutional Party leader in Estonia, 


became one of the main agitators of pro-Russian propaganda dissemination and compatriot 
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policy.399 In early 2007, before the Bronze Soldier riots, Zarenkov met several times with 
Vadim Vassilyev, the Russian embassy’s first secretary, who coordinated Zarenkov’s 


subversive messages to the public.400 


Dimitriy Linter, one of the main organizers of the Bronze Soldier street riots, was 
an auxiliary activist in Estonia, whose task was most likely to create a pro-Kremlin 
ideological auxiliary force consisting of local Russians. Nonetheless, this required the 
creation of appropriate preconditions. He was a former member of the Russian Party in 
Estonia, and became more engaged in 2005 when planning several propaganda and protest 
activities against Estonia and Latvia with his Latvian counterparts.49! Like Zarenkov, 
Linter repeatedly met with the Russian embassy senior advisor, Sergey Overtenko, in 


Estonia.402 


The population-splitting strategy supported by Russia and amplified by Estonian 
auxiliary activists created a suitable situation in 2006, when people attacked the Estonian 
flag at the Bonze Soldier site, and Linter was able to start an auxiliary movement, Night 
Watch. In reality, however, Night Watch was not very effective because despite the efforts 
of Linter and other activists, Maksim Reva, Dmitry Klenskiy, and Mark Siryk, to expand 


the organization, it had no more than twenty to thirty active members.403 


Many Night Watch members and people associated with this group did not always 
take Linter seriously or at least did not follow him as an authoritative leader. Many 
members of the Russian community in Estonia shared this auxiliary group’s ideology, but 
the Night Watch did not become a representative figure of the community. This auxiliary 
group was not able to increase its membership much in a year. Still, they were able to 


increase tensions in Estonian society through their provocative activities, such as guarding 
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the figure of the Bronze Soldier in Soviet uniform and distributing leaflets with hostile and 


manipulative messages.404 


The Night Watch and its leaders were involved in provoking the street riots. 
However, at the time of the unrest, their role was more marginal, as the majority of 
protesters joined the riots spontaneously and in improvised ways. This pro-Kremlin 
auxiliary group played a part in starting the unrest, but while it lasted, it was chaos that no 
one was able to control or direct. Besides the simple destruction of the city center’s 
infrastructure, there was no central follow-up idea, and the police suppressed the riot. When 
destroying the city center was the goal, the Night Watch met its purpose, but if the plan 
was a long-term and more profound crisis that could have led to the government’s 


resignation, the auxiliary group and its leaders failed. 


6. Proxy Actors 


During the Bronze Soldier street riots, Nashi leaders in Russia tried to send 
organization members to Estonia to support Night Watch auxiliaries. Nashi members who 
wanted to travel to Estonia did so mainly for financial remuneration and excitement, thus 
for personal gain and self-interest.495 Therefore, in the Bronze Soldier events context, 
Nashi was primarily a proxy organization whose members were ideologically pro-Kremlin, 
but operated for their own interests and benefits. This Nashi support effort to Russian 
speakers in Estonia failed because most of the members were turned back from the 
Estonian border. A few who were able to enter the country arrived in Estonia on April 29, 


when the riots in the streets were already suppressed.406 


The blocking of the Estonian embassy in Moscow shows how the Russian 
authorities used proxy organizations, Nashi and Molodaya Rossiya, to pressure and harass 
Estonian diplomatic representatives. The Kremlin directs, supports, and finances the 


activities of both groups.407 According to Professor Rene Vark of the Estonian University 
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of Tartu, “Russia used the youth organizations for activities it did not want to carry out 
through agents of governmental authorities.”408 Most likely, members of these 
organizations, such as Nashi and Molodaya Rossiya, are ideologically driven. Yet, while 
they were blocking the Estonian embassy in Moscow, they were acting out of self-interest. 
In that case, protesters were paid 550—1000 rubles (7.45—13.50 U.S. dollars) a day for their 


activities.499 


At the same time, Russian law-enforcement authorities directly supported the 
activities of members of Nashi and Molodaya Rossiya in the blockade of the Estonian 
embassy. Moscow police forces usually react very strongly and decisively to protests in 
the Russian capital, but at the Estonian embassy, the police responded passively and 
apathetically.419 It is not known whether the members of Nashi who attacked the Estonian 
ambassador with pepper spray and later organized an ambush on the street, which is an 
outrageous violation of diplomatic rules, have been prosecuted and punished. After the 
Estonian ambassador left Moscow, the protesters removed their camp and the police their 


barriers practically synchronously, like a united team.4!! 


The protesters also had an apparent and well-prepared base camp that did not 
support the seemingly spontaneous gathering of “young rebels,” but instead signaled well- 
organized and planned preparations and support from higher authorities. The protesters 
were set up with outdoor toilets, an outdoor kitchen, more than thirty identical tents, power 
supply, modern water appliances, cleaning from Moscow’s municipal services, proper 
sound equipment, and good quality posters that changed every day.4!2 This support system 
allowed them to operate in shifts without interruption. Also, protesters were brought by 


buses from other Russian regions, and according to the Estonian Eesti Pdevaleht 
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newspaper, the farthest arrivals were from Mordovia, 445 kilometers (276 miles) from 


Moscow.4!3 


a. Creation of Possible Russian Auxiliary and Proxy Forces in Estonia After 
2007 
A pertinent example of Russian auxiliary and proxy forces involves knife fighting 
clubs and the figure of one Russian named Kirill Lyubin who appeared to Estonia in 2009, 


two years after the Bronze Soldier events. 


According to the U.S Army’s John F. Kennedy Special Warfare Center and 
School’s 2019 regional threat overview, “It has been thoroughly reported in the media that 
Russia sponsors numerous tactical training organizations in the Baltic States and Balkans 
including paintball, airsoft and knife fighting clubs to recruit and exert influence.”4!4 Anne 
Applebaum from The Washington Post specifies that “Russian trainers with military 
connections—even special forces connections—have joined some clubs in those countries 


as trainers, teaching what one observer described as “small unit tactics”.”4!5 


In Estonia, knife fighting is practiced among enthusiasts of certain martial arts 
clubs, but it is not known that knife fighting is widespread among large groups. Still, public 
sources found by the author show that, at least from 2009 until 2011, knife fighting 
workshops and seminars in Estonia held by an instructor from Russia have been advertised 
in Estonian Russian-language martial arts Internet forums.4!6 The instructor, Lyubin, has 


been a Russian citizen and senior instructor of the Russian knife fighting school Tolpar.4!7 
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Lyubin advertises himself as “a reserve officer of the special forces unit of the FSB of 
Russia, President of the Russian Knife Fighting Federation.”4!8 Also, it appears that he is 
an alumnus of both the FSB Academy and the Russian Academy of State Service under 
the President of the Russian Federation.4!9 Lyubin has been working as a knife fighting 
instructor since 2004 and has conducted seminars and courses in Estonia, Lithuania, 
Ukraine, France, Italy, and India.429 The Estonian branch of the Russian knife fighting 
school Tolpar was opened in the Estonian city of Paérnu, where it recruits new members 


and enthusiasts.42! 


Lyubin has trained Russian special forces in Russia as well. Lyubin’s public 
Facebook account includes a photo (uploaded December 4, 2014) in which he participates 
in a tactical training near Khimki, a Moscow suburb, as part of a small unit or a special- 
purpose unit-like group, and several others (uploaded 2016-2019) in which he participates 
at a tactical training of a similar group in the Moscow suburb of Balashikha, at the Vityaz 
training center. The Vityaz training center is also known as the 604th Special Purpose 
Center of Russian Internal troops.422 Lyubin’s previous connection to the Internal Troops 
can be seen in a 2014 photo on his Facebook account, under which he comments that he 


conducted knife fighting training for Russian Internal Troops special-purpose units. 


The Internal Troops of Ministry for the Internal Affairs of Russia (BuHytpeHHue 
Bolicka MuHuctepcTBa BHYTpeHHUX eu, Vnutrenniye Voiska Ministerstva Vnutrennikh 


Del — VV MVD) were transferred to Rosgvardia (the Russian version of the U.S. National 
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Guard) in 2016 and are routinely involved in annual strategic exercises with the FSB.423 
These forces have a wide range of responsibilities, from covert operations to military 
action; they played a central role in both Chechen wars (1994-1996, 1999-2009) and have 
actively participated in most of Russia’s contemporary armed conflicts.424 Combined, their 
abilities cover “intelligence collection, propaganda and information campaigns, 
coordination of criminal and paramilitary groups, covert operations, cyber operations, and 
support operations during the active phase of military operations and insurgency.”425 The 
604th Special Purpose Center units are also used to support the FSB elite special units from 


FSB Special Operations Center (FSB SOC).426 


In addition to the Vityaz training center, the Balashikha district also houses the 
FSB’s highly secure FSB SOC, the base for the elite and secretive special units Alpha and 
Vympel, and the Vympel Association of Former FSB Spetsnaz Officers.427 The Vympel 
special unit, now in FSB SOC, was established in the KGB in 1981 to carry out subversive 
operations in foreign states, and its capacities included “illegal reconnaissance, subversion, 
kidnappings, freeing hostages, coups d’etat and assassinations of enemies to the state.”428 
According to Bellingcat’s analysis, the FSB SOC and the Vympel Association prepared 
and supported a Russian citizen with a criminal background who is suspected of the 
assassination of Georgian Zelimkhan Khangoshvili on August 23, 2019, in Berlin, 
Germany.429 This is just one example from public sources, but it shows that the units in 


Balashikha are planning and preparing complex and covert operations abroad. 
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Based on available public sources found by the author, Lyubin cannot be directly 
linked to the FSB SOC and the Vympel Association, but these sources show that he is a 
former FSB special unit member and currently the FSB captain in reserve. Sources also 
show his connections with the VV MVD special-purpose units and his participation in 
tactical exercises at the Balashikha base, whose units cooperate with and support nearby 
FSB special units. FSB special units, especially Vympel, specialize in subversive 
operations abroad and have on-the-ground experience in recent conflicts, such as in 
Ukraine and Syria. Lyubin’s FSB background, his presence and tactical training in 
Balashikha, as well as the specifics of the units there, which would be suitable for preparing 
and conducting operations in Russia’s hybrid campaigns, suggest the sorts of non-state 
agents that Russia could use to gain adherents in foreign lands. Against this background, 
Lyubin’s connection with Estonia—the courses and training he has conducted and the knife 


fighting club Tolpar in Paérnu-—is significant. 


Ts Organized Crime 


In Estonia’s case, there is no proof that the Russian special services recruited people 
directly from the criminal world or that local auxiliary leaders knowingly cooperated with 
organized crime in the framework of the Bronze Soldier events to accomplish their 
objectives. The majority of destructive and looting protesters detained and arrested by the 
police were seventeen- to twenty-four-year-old Russian-speaking Estonian residents.439 It 
is noteworthy that “people suspected of crimes or other offenses during the riots had 
probably (74% of cases) committed some before.’43! But most of the rioters joined 
spontaneously. The high percentage of criminality among detainees most likely shows that 
people who have already broken the law possess the mindset or tend to do so again more 


easily once the opportunity arises. 


Although the involvement of organized crime did not emerge in the Bronze Soldier 
case, it is relevant in the framework of this thesis to provide examples of the previous links 


of Estonian crime to Russia and how Russia uses criminal groups against Estonia. 
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By the beginning of the 1990s, when Estonia became independent, there was, as 
elsewhere in the former Soviet Union territories, organized crime, which global 
commentators often refer to as the “Russian mafia’.432 Organized crime, which developed 
in the conditions of independent Estonia, did not differ from its traditions with the criminal 
traditions valid elsewhere in the former Soviet Union.433 In 1997, the director-general of 
the EISS warned that Estonia, at the crossroads of international crime, was in danger of 
becoming a transit country for the smuggling of drugs, weapons, and nuclear materials by 
Russian organized crime.434 At the time, Russia had enough internal problems, leaving 
organized crime to act mainly in its own interests in Estonia, and it was not yet used as a 
tool against Estonia.435 In the first half of the 2000s, Estonia began to change from a 


country of origin for Russian organized crime to the country of destination.436 


Today, the close link between organized crime with a Russian background and 
Russia’s special services and other branches of power has been repeatedly confirmed; in 
essence, Russian organized crime and Russian security authorities are inseparable.437 
Russian-linked organized crime in Estonia tries to take advantage of the relative absence 
of the Russian-speaking population in the country’s governance.438 By offering a “‘pseudo- 


patriotic” alternative to public authority, it sometimes tries to organize socio-economic 
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relations of the Russian-speaking community.439 Russian special services are trying to take 
advantage of both right- and left-wing extremist movements through organized crime to 
provoke conflicts and fracture countries in Europe and also in America.440 Russia has tried 
to do this in Estonia as well, especially in the first half of the 2000s, but EISS has quickly 
and effectively suppressed these movements.*4! As a result, extremists in Estonia have not 
been able to assert themselves, and therefore, extremism is not a significant threat to 


Estonia’s national security.442 


On the other hand, anti-Estonian cooperation between organized crime and Russian 
security authorities is ongoing in cross-border smuggling and human trafficking. Cross- 
border smuggling, as well as human trafficking, is a problem around the world. What 
makes it different in Estonia and the Baltics is that organized crime, in its operations on 
the state borders, is directly an extension and a tool of the Russian intelligence and security 


services.443 


Individuals engaged in illegal cross-border activities, including dual citizens, are 
easy prey for the Russian special services—especially for the FSB, which includes the 


Russian Federation’s border guard service.444 Recruitment is also facilitated by Russian 
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propaganda and biased Russian media, which creates a “national-romantic” image for spies 
and treats them as heroes.44> There is seemingly a symbiosis between criminals and 
intelligence services, where crime generates commercial profits, but the cost of doing so is 


also the performance of intelligence tasks.446 


Furthermore, the criminals use technical means in their operations that are not 
readily available on the free market, suggesting that from time to time, their activities are 
likely to be directly supported by the Russian security services.447 Press reports state that 
EISS has since 2015 arrested seven FSB collaborators involved in cross-border organized 
crime.448 As a whole, their tasks were to gather information on the capabilities, personnel, 
activities, and equipment of the Estonian police, border guards, security agencies, the 


defense forces, and Estonia’s allies active in Estonia.449 


Criminals operating at the border have become experts in their activities in the 
region and the border area. As a result of their actions, they have probably learned in detail 
about the border landscape’s peculiarities, the local population, and the road networks. 
They are also building safe-houses and supply caches and getting to know the operational 
routines and specifics of the Estonian border guard. All the nuances of operating on the 
Estonian-Russian border, both successful and unsuccessful, are likely to be passed on by 
criminals to the FSB as well. The FSB’s tasks include gathering intelligence and 
coordinating criminal groups.4>9 These tasks are often interlinked.45! In a crisis, such long- 
term knowledge of the details of the border zone and the Estonian border guard’s operating 
procedures is essential for the Russian special services in planning and conducting 


operations. 
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It is important to point out that the Estonian region where the main smuggling and 
trafficking operations are carried out borders the Pskov region (Pskov oblast). This oblast 
is the most important outpost for Russian troops and special services on NATO member 
states’ borders.4>2 About fifty kilometers (thirty miles) from the Estonian-Russian border 
is the town of Pskov, home to the GRU 2nd Independent Spetsnaz Brigade and the 76th 
Airborne Assault Division. A former commander of the Estonian defense forces and 
current politician, retired General Ants Laaneots, said in 2014 that, according to his 
knowledge, the 2nd Spetsnaz Brigade units have been secretly practicing crossing the 
Estonian border for years.4°3 According to Alexey Ramm, a Russian military 
correspondent and editor of military affairs in /zvestia newspaper, “The main role the 
[GRU] Spetsnaz units are now expected to perform is unconventional warfare operations 
authorized by the senior Russian leadership.’’4>4 It is known from the conflict in Ukraine 
that Spetsnaz’s agents and collaborators were recruited from, among others, criminal 


groups that were used with preparing a suitable environment for Russia’s political goals.455 


Private security companies also are linked to Russian intelligence. The GRU 2nd 
Spetsnaz Brigade has links, at least indirectly, with Wagner PMC. Their leader and 
founder, Dmitry Utkin, retired from the military as a lieutenant colonel in 2013, leaving as 
the commander of one of the units in the 2nd Spetsnaz Brigade.4>® It is known that Wagner 


PMC trains and builds its training facilities near the Spetsnaz brigades, and it is known that 
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through or initiated by the GRU, Russian PMCs operate alongside criminal groups.497 
Thus, it is possible that preparations have been made in the Russian-Estonian border zones 
for the possibility of infiltrating Estonia with supporting affiliate or proxy groups should 


the next conflict arise. 


F. CONCLUSION 


The 2007 Bronze Soldier riots were among the first post-Soviet events in which 
Russia’s influence and the exploitation of the local Russian-speaking diaspora created 
internal tensions abroad, and which Russia then exploited and tried to steer to its advantage 
without using military force. Russia’s strategy in the context of the Bronze Soldier incident 
was successful in the sense that it is not possible to directly demonstrate or prove the 
Russian state’s involvement and support in carrying out or leading the riots and 
concomitant activities such as cyber-attacks.4>8 Thus, from this aspect, Russia’s 
exploitation of non-state actors beneficial to the country, or at least the enabling of their 
actions, served the purpose in Estonia in 2007. Nevertheless, after provoking the riots and 
likely enabling the first-ever cyber-attacks against a foreign country, the Russian 
Federation was forced to admit that aggressively combined non-military means— 
information operations and propaganda, hostile local groups, cyber-attacks, and diplomatic 
pressure—were not enough to overthrow the Estonian government or change its political 
course.459 Therefore, the Bronze Soldier case as a whole is an example of the relative 


failure of the Russian NWT against Estonia in 2007. 


Aggressively combined non-military actors in the Estonian context seems to mean 
that non-state actors were simultaneously active in the same window of time, but there are 


minimal, if any, signs of coordination. Propaganda and influence campaigns in the media 
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divided the Estonian population and culminated in street riots. The anti-Estonian narratives, 
repeated in the press, also probably supported finding people who took part in cyber-attacks 
according to instructions shared on the Internet. Russia’s general strategy in Estonia created 
a so-called favorable ground, where the accumulation of tensions formed a number of 
people whose general goal seemed to be to release their anger and retaliate against Estonia 
and its government. It seems to the author that there was no follow-up plan after the starting 
of the street riots. Russian security agencies may have involved the cyber-attacks through 
cyber criminals because the right environment or opportunity arose to test their impact and 
capabilities, creating additional confusion and overburdening the target country’s 
governing bodies. Therefore, it seems to the author that the Bronze Soldier case in Estonia 
was the testing of NT'W components, the aim of which was to see whether non-state actors 
supporting Russia’s foreign policy goals could independently achieve a goal suitable for 


Russia without Russia’s direct command and control. 


The conflict mainly involved the Estonian capital, Tallinn, and smaller towns in 
eastern Estonia closer to Russian border. Its active phase was relatively short-lived, and 
Estonian law-enforcement and security structures were able to quell and resolve the crisis. 
However, it showed that an influencing strategy of Russian origin could initiate a domestic 
social conflict in Estonia through information and cyber operations. Although the rioters 
became violent on the streets, their actions were improvised and accidental, and the 
organizers of the protests were unable to direct the events systematically. Russia did not 
use organized violent and armed non-state actors against Estonia. On the other hand, if 
systematically operating armed groups had also supported rioters, the Bronze Soldier case 


could have ended differently. 


Despite the successful result for Estonia, it can be said that the unresolved causes 
of the Bronze Soldier incident, the impacts of the events, and the lessons learned by Russia 
that it continues to develop and apply in Estonia, have left the case open. After 2007, Russia 
has continued its malign information and influence campaigns attempting to divide 
Estonian society. As the influencing techniques that caused the crisis worked in 2007, 
Russia continues to use them and hinder the integration of Estonians and Russian-speakers 
living in Estonia through state-controlled media, journalists, influence agents, and NGOs. 
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The policy to integrate Estonians and Russian-speakers continues to pose 
challenges for Estonia. In turn, this situation leaves open the possibility that the discrepancy 
between nationalities and the resulting historical memory can be re-used in Estonia to 
create a next conflict similar to the Bronze Soldier case. It is possible that to create a new 
conflict, Russia will just have to find a new symbol that can be historically interpreted in 


many ways, around which to build a new campaign of subversion. 


Possible Russian efforts to prepare local violent auxiliary groups, such as knife 
fighters, shows that their participation should already be taken as a given in the next similar 
crisis in Estonia. Also, cooperation between organized crime and Russian intelligence 
agencies at the state-border indicates that should the next crisis arise, Russia is likely to 
have prepared for escalation using these actors and their preparations at the border. Their 
cooperation can be the groundwork to enable additional Russian proxy, affiliate, and 


auxiliary forces to infiltrate Estonia to support locals in a crisis. 
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IV. MONTENEGRO 


A. INTRODUCTION 


This chapter is a case study of Russian NTW activities in Montenegro, a small 
mountainous country on the Adriatic Sea in the Balkans. Montenegro was one of 
Yugoslavia’s federal republics until 2003. From 2003 to 2006, the country was a part of 
Serbia and Montenegro. Montenegro became independent as a result of a referendum in 
2006 and has been a member of NATO since 2017. The Balkan countries have a historical 
connection with Russia, and Moscow still considers the region as within its sphere of 
influence. In order to increase and consolidate its influence and ability to direct processes 
in the Balkans, Russia is trying by all means to counter the expansion of Western power 
into the region. This is best illustrated by the failed Russian-sponsored coup attempt in 


Montenegro in 2016. 


The second section of this chapter introduces the reader to Montenegro’s 
geographical location and briefly describes the state structure. In order to better understand 
the reasons for the 2016 coup attempt, the author describes the relations between 
Montenegrins and Serbs and how they affected the events in the region and Montenegro’s 
accession to NATO. The section then describes how Russia is trying to consolidate its 
influence in the Balkans and the reasons that led to the failed coup attempt in 2016 to 


prevent Montenegro from joining NATO. 


The third section first briefly explains the events and environment immediately 
preceding the planned coup. It then describes which actors were involved in planning, 
organizing, and attempting to carry out the coup. This section also provides an overview 
of how the coup was planned and what activities were planned. Finally, this section 


describes why the planned coup attempt did not materialize. 


The fourth section first analyzes Russia’s influence in the region before the failed 
coup attempt in Montenegro, specifically what methods and pro-Kremlin non-state actors 
it used in its attempts to achieve its goals. The following part analyzes how Russia used 


the media in its influencing strategies and which local pro-Russian actors took part in these 
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activities. Third, the section examines the cyber-attacks, which were the only activities 
carried out against Montenegro on its referendum day, when the coup attempt was to occur. 
The fourth part of the section investigates the Russian state service behind the coup plot, 
the GRU and its two officers from the covert unit 29155, who were the coup planners, 
financiers, and initiators. The final part of this section analyzes the violent pro-Russian 
auxiliary, affiliate, and criminal proxy actors involved in the planned coup and their 


background, reasons to be involved, and roles. 


The last section of the chapter summarizes the reason, the plan, and the preparation 
of non-state actors for the coup, which was intended to overthrow the Montenegrin 
government and suspend NATO accession. The section concludes that the Russian NTW 
campaign in Montenegro in 2016 was a failure resulting from one weak link, as one of the 


coup plotters became an informant for the Montenegrin police. 


B. MONTENEGRO’S GEOGRAPHICAL LOCATION, STATE 
STRUCTURE, POPULATION, AND NATO MEMBERSHIP 


Montenegro is a parliamentary republic. Independent executive, legislative, and 
judicial authorities govern the state. The president is the head of state, who is directly 
elected for five years. The prime minister chairs Montenegro’s unicameral parliament. The 


state’s judicial system includes the Constitutional Court and a Supreme Court.469 


Montenegro has a population of approximately 610,000, 45 percent of whom are 
Montenegrin, 29 percent Serbian, 9 percent Bosnian, and other nationalities such as 
Albanian, Muslim, Romani, and Croat. About 5 percent of the population is of unspecified 


origin.461 


Formerly, Montenegro was a member state of the Socialist Federal Republic of 


Yugoslavia. After the union’s collapse, Montenegro joined its neighboring state Serbia to 
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establish the Federal Republic of Yugoslavia in 1992.462 From 2003 to 2006, Montenegro 
was part of a federal union with Serbia.463 After gaining its independence in a peaceful 
nationwide referendum in 2006, Montenegro’s political leadership set Western integration 
a priority in the state’s constitution.464 As well as establishing a stable economy, NATO 
membership became one of Montenegro’s primary goals.46> Montenegro joined the 
Partnership for Peace in December 2006, and became a full member of NATO in June 


2017.466 


While most of Montenegro’s population supports the state’s integration into the EU 
and a consensus has also been reached among politicians, NATO membership has divided 
both citizens and politicians.467 Some Montenegrins see the future of their state in close 
connection and cooperation with the democratic West, while others favor an alliance with 
the Russian Federation. Many emphasize the importance of their own statehood. These 
people favor maximal autonomy from Serbia, while others in Montenegro favor close 


relations with Serbia, which they still consider a “mother country.”468 


iF Russia’s Interests in the Balkans and Montenegro 


As previously noted, Russia considers the Balkans to be part of its sphere of 
influence. Therefore, it is trying to counter any expansion of Western influence in the 


region, as this will reduce its own power in the area.46? Russia’s central informational 
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method of consolidating its presence in the Balkans is exploiting the ultranationalist 
emotions in pan-Slavism and eastern Orthodoxy—a concept that “suggests that borders are 
irrelevant to the transcendent need to unite ethnic [Slavic peoples and Orthodox 
faithful].”479 By emphasizing the Russian empire’ s historical role in protecting and uniting 
the Slavic world and people, Moscow can display its role as the region’s guardian from the 
outer non-Slavic influences.47! Moscow is trying to implement the narrative in the Balkans 
that “only Russian president Vladimir Putin is the true “defender of the faith,” and all that 


is culturally traditional and conservative.”472 


With a broad emphasis on Slavic heritage, a common Orthodox Christian religion, 
and Russia’s historical patriarchal role in the region, the Russian leadership is primarily 
committed to exploiting ethnic Serbs to achieve its goals and secure its presence.473 Almost 
30 percent of Montenegro’s population is ethnic Serbs. Most of them identify with their 
Slavic heritage and support the concept of a Greater Serbia, in which all ethnic Serbs would 
be unified into one state and territory. As Russia has promoted itself as Serbia’s ally, these 


Serbian-Montenegrins support stronger relations with Moscow.474 


In 2013-2014, Russia began to show increased interest in Montenegro compared 
to other Balkan countries due to Montenegro’s geographical location.4/> The state’s ports 
of Bar and Kotor provide deep-sea access to the Mediterranean.47© At the time, Russia had 
lost confidence in its naval base in Tartus, Syria, and without a reliable port for its navy in 


the eastern Mediterranean, Russia’s strategic capabilities in the region were hindered.477 
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In September 2013, Moscow requested a meeting with the Montenegrin ministry of 
defense to discuss establishing a Russian naval base in Montenegro.478 Anna 
Borshchevskaya notes that “a port allows a country to project power and support military 
operations. Russian naval presence in the Eastern Mediterranean helps protect against a 
possible blockade seeking to punish or topple the Bashar al-Assad government in 
Damascus.”479 In 2013, Montenegro refused Russia’s request to use its deep-water ports 


temporarily to moor Russian warships.489 


By 2016, Moscow had not yet made any measurable progress in achieving military 
cooperation with Montenegro.48! Montenegro’s joining NATO closed even the theoretical 
possibility that Russia would have a friendly route to the Mediterranean via the Adriatic 
Sea from the Balkans.482 Politically, Montenegro’s vigorous approach to the West and 
joining this military organization thwarted regional ethnic Serbian aspirations to create 


Greater Serbia and Moscow’s efforts to increase its influence in the Balkans.483 


Ce THE 2016 COUP ATTEMPT 


On election day, October 16, 2016, then prime minister Djukanovic announced that 
the previous day, twenty individuals had been arrested by Montenegrin special services for 
planning a coup d’état in Montenegro and his likely assassination.48+ According to 
Montenegro’s chief special prosecutor Milivoje Katnic, the intended coup involved 
Serbian, Russian, and Montenegrin citizens and aimed to change Montenegro’s political 


system, and thus prevent the state from joining NATO.485 
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if Immediate Events and Environment Leading to Failed Coup Attempt 


On December 2, 2015, the NATO military alliance invited Montenegro to start 
accession talks.486 As Montenegro was Russia’s main potential ally through which Russia 
could have gained access to the Mediterranean, Russia’s response was swift, and on the 
same day, Kremlin spokesman Dmitry Peskov threatened Russia’s retaliatory steps if 
Montenegro joined NATO.487 The Russian parliament threatened Montenegro that all 
cooperation projects, including defense cooperation, would be frozen if Montenegro 
entered the Western military organization.488 Despite these Russian threats, then 
Montenegrin prime minister Milo Djukanovic signed an accession protocol with NATO in 


May 2016.489 


Starting the NATO accession process was a political decision in Montenegro, 
which was controversial from the people’s point of view, as up to half of the country’s 
population was opposed to joining NATO, according to various estimates.490 The 
parliamentary elections in October 2016 were considered a referendum on joining the 
Euro-Atlantic military alliance, which had been agreed upon in advance but had not yet 
entered into force. The Montenegrin parliament needed to ratify the treaty for it to come 
into force.49! If the opposition had won this election, the country’s accession to NATO 


would have been suspended on Montenegro’s own initiative.492 
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2. The Coup Attempt Planners and Organizers 


Behind the coup attempt plan were two GRU officers, Eduard Shishmakov (alias 
Eduard Shirokov) and Vladimir Moiseev (alias Vladimir Popov), who recruited Serbian 
citizen Aleksandar Sindjelic as the plot’s main organizer.493 Sindjelic, a convicted criminal 
who had fought on the separatists’ side in eastern Ukraine, was the leader of an anti-NATO 
and pro-Kremlin paramilitary group, the Serb Wolves, and a member of another, the 


Balkan Cossack Army (BCA).494 


Sindjelic, in turn, hired a former chief of Serbia’s special police and BCA member, 
Bratislav Dikic, and recruited Montenegrin resident Mirko Velimirovic. Sindjelic and 
Dikic formed a criminal group that would play the primary role in the assassination of then- 
prime minister Djukanovic and by doing so help to seize power in Montenegro. 
Velimirovic’s task was to obtain weaponry from Kosovo, participate in the coup, and 
recruit additional cooperators from Montenegro to take part in the coup’s riots.49> In 
addition to those directly participating in the kinetic operations, almost five hundred 


conspirators were planned, recruited, or involved to participate in the coup.49© 


The coup plan, however, did not materialize because Velimirovic became a police 
informant a few days before election day.497 Through Velimirovic, Montenegrin security 
forces arrested Sindjelic and Dikic and, on election day, the remaining principal 


perpetrators, with the exception of two GRU officers.498 


3. The Coup Plan 


The coup plan had been to hold an anti-government demonstration in front of the 


parliament building on referendum day, October 16, and to infiltrate the protest with armed, 
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trained, and conflict zone-experienced operators.499 Some of the operators were to be 
dressed in Montenegrin police uniforms.5°9 Then, after the elections at eleven in the 
evening, two politicians, Andrija Mandi¢ and Milan KneZevic¢, leaders of the Montenegrin 
anti-NATO and pro-Russian Democratic Front, were to step up and trigger the crowds to 
start the riots and provoke them to assail the parliament.59! Under the guise of protesting 
crowds, armed groups that had infiltrated the public were to forcibly break into the 
parliament building.592 Meanwhile, at the start of the unrest, the operators disguised in 
police uniforms were to start the ‘false-flag’ operation by shooting at the opposition 
supporters and demonstrators as if they were the “government’s police units.”>°93 The 
Democratic Front would then instigate widespread national protests, accusing the 
government of killing innocent people and claiming that the government’s brutality was an 
effort to counter the “victorious” opposition from taking control.594 At the same time, 
armed groups that were to break into the parliament building were to assassinate then- 
prime minister Djukanovic and subsequently keep the building under control for at least 
forty-eight hours.°9> Eventually, the groups that occupied the building would have handed 
over responsibility to the pro-Kremlin Democratic Front, which would have changed 


Montenegro’s foreign policy and suspended its negotiations to join NATO.39 


On May 9, 2019, the Montenegrin Supreme Court convicted a group of fourteen 
people of attempted terrorism and the creation of a criminal organization that aimed to 


assassinate the prime minister, overthrow the Montenegrin government, and prevent it from 
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joining NATO.5°7 Two GRU officers, Shishmakov and Moiseev, who managed to escape 
through neighboring Serbia, were sentenced in absentia to fifteen and twelve years in 
prison, respectively, but it is unlikely they will serve their terms.°°8 Two Montenegrin 
opposition politicians, Mandi¢ and KneZevic, were both sentenced to five years in jail, and 


the other sentences varied from parole to eight years in prison.>99 


The next section of this chapter takes a closer look at Russian state and non-state 
actors, as well as local auxiliaries, affiliates, and proxies involved in the planned coup. The 
following section examines the means Russia used to sow its influence in the region to 
distinguish groups of people suitable for pursuing Moscow’s interests. The section also 
analyses how non-state actors were connected with Russia and with each other, and what 


their activities were in planning the coup. 


D. ANALYSIS OF RUSSIAN AIMS AND USE OF STATE AND NON-STATE 
ACTORS IN THE PLANNED COUP 


The Russian Federation has sought to keep the Balkan countries in its sphere of 
influence, expand its capacity in the region to direct the various state processes, and prevent 
Western countries from expanding their influence into the region. As the Montenegrin 
government took a decisive step towards the West and planned to join the NATO military 
alliance, Russia saw a dangerous sign of Western power expansion into the Balkans. Also, 
Montenegro’s decision deprived Russia of the opportunity to gain naval access from the 
Balkans to the Mediterranean. For these reasons, Moscow tried to prevent Montenegro 


from moving towards the West and joining NATO. 


As noted earlier, on October 16, 2016, the day of the local parliamentary elections, 


Russia, through its agents in Montenegro and Serbia, attempted a violent coup d’etat, under 
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the guise of a bogus “popular uprising,” to prevent a pro-Western election victory.>!9 The 
Russian Federation’s strategy in the Montenegrin capital, Podgorica, was very similar to 
its previously conducted activities in Ukraine, as it involved the occupation of a 


government building by local pro-Russian actors, as in Donbas in eastern Ukraine.>!! 


In attempts to achieve its goals in Montenegro, Russia relied on all distinctions of 
violent non-state actors—affiliates, auxiliaries, and proxies. As described in Chapter II, 
affiliates have a symbiotic and formal but legally questionable relationship with the 
sponsoring state steering the activities. Affiliates are often mercenaries formed into private 
or contract units capable of independent influence campaigns, violent operations, and 
power projection. Auxiliaries, by contrast, are armed or violent ideologically driven and 
motivated volunteers that are not part of the sponsoring state’s formal units but are directly 
engaging in violent activities in the operating environment in favor of the sponsoring state. 
The third group, proxies, comprises third-party agents whose interests align with the state 
sponsor’s aims. They can be ideologically supportive of the sponsoring state, but the main 
reason for their involvement in the conflict is their own interests, like grievances against 


another group in the target state. 


1. Russian Influence Strategy Before the Planned Coup in 2016 and 
Implementing Auxiliary and Proxy Actors 


Before the coup attempt, there was no direct and coordinated campaign of influence 
to divide the people, as the Montenegrin population was itself deeply polarized. As early 
as 2006, the referendum on the independence from Serbia clearly highlighted the 
Montenegrin population’s segregation into Montenegrins and Serbs based on their ethnic 
and linguistic background.5!2 In 2006, 44.5 percent of the population voted against 
secession from Serbia.>!3 As a result Russia easily found groups among the people of the 


region who were ready to take decisive action in halting the spread of Western influence 
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in the region. Russian and the local pro-Kremlin auxiliary and affiliate actors had a 
favorable opportunity to direct opponents, mainly Serbs, of Montenegro’s independence 


and pro-Westernism against joining NATO. 


Russia’s long-standing influencing plan before the coup d’ état did not directly aim 
at Montenegro but the Balkan region in general.>!4 The primary strategy of influence was 
to emphasize pan-Slavism and to highlight, amplify, and link Serbian nationalism to the 
Russian nation that allegedly shares similar values. As a result, all others in the region, who 
did not support these values, could in themselves be portrayed as opponents and even as 
“enemies,” advocates for Western interests. As the Russians saw during the preparatory 
period for the coup, social divisions and the resulting beliefs among the Balkan nations 
were sufficiently sharp that ethnic Serb auxiliary actors were willing to go extremes to 


“protect” the region. 


In an attempt to renew and demonstrate the Russian empire’s historical role in 
protecting the Slavic world, and continuously opposing it with the West, Russia sought to 
demonstrate its role as a defender of the region from Western expansion and the West’s 
so-called harmful influence.>!5 To depict the so-called common Russian world, to 
consolidate its influence, and to build a nation-based bridge, in addition to emphasizing 
ethnic inheritance, Russia also needed to bring another essential element into play—the 
Orthodox Church. Around 2010, the Russian Orthodox Church began working closely with 
the influential Serbian Orthodox Church in Montenegro, which resulted in the construction 
of three Russian Orthodox churches in the country.>!© This cooperation was one of the 
comerstones of anti-Western and anti-NATO advocacy, leading to more apparent 


opposition movements.>!7 
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The Serbian Orthodox Church leader in Montenegro, Archbishop Amfilohije 
Radovié, positioned himself as one of the leading figures in the anti-NATO campaign.>!8 
Radovi¢ became an influential Russian auxiliary figure in the region that used his links and 
cooperation with Russian representatives in Montenegro and Serbia to block Montenegro’s 
path to the Western military alliance.>!9 He became a distinguished visitor at various 
events committed to Montenegro’s military neutrality concept and the holding of a 
referendum on joining NATO.529 In May 2016, he gave an official blessing to a declaration 
signed between the Montenegrin political opposition Democratic Front and the United 
Party of Russia, led by president Putin.>2! The author describes this event in more depth 


in the following paragraphs related to Montenegrin pro-Kremlin political actors. 


While the Serbian Orthodox Church was not directly involved in the coup attempt, 
it hosted a meeting of coup leaders in the Montenegrin Ostrog monastery the night before 
it was supposed to take place.>22 The Serbian Orthodox Church is known for its support 
for Serbian nationalists and continues to have a strong influence in Montenegro, where 
three-quarters of the population is Orthodox.>23 The Serbian Orthodox Church provides 
political and financial support and logistical assistance to Montenegro’s anti-Western and 


anti-NATO forces.524 


In June 2014, the Serbian Church inducted former KGB and SVR General Leonid 
Reshetnikov into the Order of the Holy Emperor Constantine for “nurturing and spreading 


of Orthodoxy.” Reshetnikov was then director of the Kremlin-owned Russian Institute for 
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Strategic Studies (RISS).525 RISS is a Russian affiliate organization that, in addition to 
promoting the Kremlin’s foreign policy goals in the Balkans, also consolidates and 


supports influence agents and finances anti-NATO groups in the region.526 


Reshetnikov was one of the strongest public critics of Montenegro’s movement 
towards NATO and committed RISS to intensively analyze and comment on Montenegro’s 
political situation before the referendum in October 2016.°27 For example, in February 
2016, Nikita Bondarev, head of the RISS Balkan Research Group, predicted a scenario for 
the upcoming referendum: protesting masses trying to break into the parliament building; 
police using violence and showering them with tear gas and rubber bullets; nevertheless, 
protesters against then-prime minister Djukanovic would not recede.°28 Bondarev 
emphasized that “in order for the decision that Djukanovic is undesirable to be taken, the 
process of protest activity in Montenegro must move to a slightly different stage. Now 
these are generally peaceful protests, but they can develop into something similar to what 
happened in Kiev on the Maidan.’”’>29 As it turned out, these ‘predictions’ described quite 
precisely what events were to take place in about eight months, in Podgorica, Montenegro’s 


capital. 


In addition to organizing and directing Russia’s influence strategy in the area, 
Reshetnikov was probably one of those who originally proposed the idea of a coup in 


Montenegro.>39 Also, Reshetnikov possibly played a role as an advisor in the preparations 
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phase.>3! He offered likely candidates for executing the coup to Moscow, after which 
authorities under the Kremlin’s direct control, such as the GRU, were given responsibility 
for planning and directing the plot.532 Less than a month after the failed coup came to light, 
President Putin removed Reshetnikov from his position as director of RISS and replaced 
him with Mikhail Fradkov, the former director-general of the SVR.°33 The replacement of 
Reshetnikov to the former head of the SVR indicates that the Russian leadership considers 
the RISS and its director’s position to be crucial tools in Russia’s strategy for influencing 
the Balkans. President Putin’s involvement also shows that the RISS is directly linked to 
the Kremlin’s pursuit of agendas in the region, and Putin saw that Reshetnikov failed in his 


duties. 


Reshetnikov’s close Russian-linked contact with whom he cooperated in the 
Balkans and likely developed the coup’s idea was the oligarch Konstantin Malofeev, an 
infamous Russian affiliate from the Ukraine conflict.°34 Malofeev was known to be one of 
the original ideologues and organizers of the occupation of Crimea and had funded and 
supervised at least two of Russia’s prominent affiliate leaders of the separatist activities in 
eastern Ukraine, former FSB colonel Igor Girkin and Alexander Boroday.>35 While 
Malofeev’s activities in the Balkans, as in Ukraine, were seemingly motivated by 
ideological and business interests, in reality he coordinated his activities with Moscow 
through RISS and Reshetnikov.°36 According to an unspecified Bulgarian intelligence 
officer, “Malofeev, [who was] very active on both economic acquisitions and political 
networking in the Balkans since 2014, originated the idea to attempt a coup in Montenegro 
in 2016. But this ultimately was too big for him to be allowed to be in charge, and Security 


Council chief Nikolai Patrushev—with Putin’s approval—took it over.”537 
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Nevertheless, in the months leading up to the coup, Malofeev worked under 
Kremlin active-measures guidelines and tried to increase the proportion of NATO 
opponents in Montenegro and the region. Malofeev, like Reshetnikov, had close 
connections with both the Serbian Orthodox Church and the Montenegrin political 
opposition, the Democratic Front.538 In 2016, Malofeev’s Russian-located Tsargrad TV 
station provided a large amount of airtime to the Democratic Front leaders Andrija Mandi¢ 
and Milan KneZevié.>39 For example, in an interview in February 2016, Mandic said that 
in the absence of a referendum on joining NATO, the country would face large-scale street 
protests and violence.°49 In the same interview, Mandic said that the Russian Duma 
speaker, Sergei Naryshkin, had promised him that forces representing Russian interests in 


Montenegro could count on Russia’s support.>4! 


2. Pro-Russian Media and Local Proxy Actors 


Montenegro and Serbia are viewed as some of the European countries least 
prepared to detect and reject false news due to backward knowledge systems and weak 
political literacy.542 From 2015 onwards, the number of media outlets and local websites 
with Russian background increased in Montenegro and Serbia, often taking information 
directly from, for example, Sputnik or other Russian media sources.°43 The messages 
conveyed through these channels systematically called for ethnic Serbs in Serbia, 


Montenegro, North Kosovo, and Bosnia’s Republika Srpska to form a unified political 
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body with a tight connection to Russia.544 These efforts were successful in dividing the 


Montenegrin public. 


As with the 2006 independence referendum, Montenegro’s population and 
politicians split in two on the question of joining NATO.°4> The main proxy actors in 
representing NATO opponents were opposition politicians and Democratic Front leaders 
Mandié and KneZevi¢. They were Russian proxy actors because they acted out of self- 
interest in order to rise to power in Montenegro. They were both involved in the planned 
coup, and they had to seize power in the country to make Montenegro’s political direction 
favorable for Russia.>46 The main role of Mandié and KneZevié was to coordinate the coup 


organizers and assist in the distribution of funds.°47 


In the period leading to Montenegro’s referendum, regional pro-Russian or 
Kremlin-supported media actively highlighted local suspicion the West and pro-Western 
Balkan politicians.>48 One of the directions of Russian influencing strategy before the coup 
was to portray Montenegro as a “traitor” and to threaten the state with severe retaliatory 
actions in the event of joining NATO.°49 This campaign aimed to sow fear and confusion. 
The pro-Kremlin media used previously proven and successful propaganda tactics to 
influence Montenegrins to tilt in an anti-NATO direction, beneficial to Russia.5>9 The 
message of Russian propaganda was that Montenegro would become the next Ukraine.>>! 
Following the Ukraine events of 2014, Russian propaganda and influencing strategy 
succeeded in creating a negative image of Ukraine and its people in Russia and many 


countries supporting Russia.552 The image created of Ukrainians depicted them as 
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“ungrateful, apostate, heading to the West, and in denial of their common historical roots 


with Russia.”553 


Another focus of Russian influencing before the coup was the ongoing denigration 
and discrediting of the West and NATO. Anti-Western propaganda regularly presented the 
West as the origin of the region’s democratic shortcomings, economic problems, and 
continuing ethnic divisions.°>4 Russian-led propaganda emphasized and _ ridiculed 
European values for protecting minorities and LGBT rights and claimed that America was 
known for supporting ethnic separatism and dividing the Balkan countries.°>> Fake news 
of Russian origin or having links to Russia regularly highlighted the narrative that Western 
decision makers prefer to support Muslim communities in the Balkans at Orthodox 


Christians’ expense.>56 


In October 2015, one year before the planned coup, the Democratic Front staged a 
large-scale protest against the prime minister and joining NATO.5°/ In 2016, the 
Montenegrin prime minister accused opposition leaders Mandic¢ and KneZevic of receiving 
financial support from the Russian Federation to organize both the 2015 protest and the 
one planned for the 2016 coup.558 In February 2016, eight months before the planned coup, 
Mandi¢ and KneZevi¢ traveled to Moscow to receive instructions from their Russian donors 


and mentors.>5? They discussed with the senior official of United Party of Russia, Sergey 
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Zelezniak, and the vice president of the Russian parliament, Pyotr Tolstoy, about the 


upcoming referendum strategy and other possible pro-Russian political moves.>69 


In May 2016, five months before the planned coup, KneZevic¢ signed, with the 
blessing of the Serbian Orthodox Church in Montenegro Archbishop Radovic, the Lovcen 
declaration on the partnership between the Democratic Front of Montenegro and the United 
Party of Russia.56! This declaration emphasized and clarified improving connections 
between the two countries, establishing an agreement of military-neutrality, and holding a 


referendum on joining the Western military alliance.>62 


Russia’s widespread propaganda and defamation campaign targeting Montenegro’s 
government, aimed at influencing the public. The campaign mainly began after the failed 
coup attempt. The Russian media and news channels, which in turn are covered by pro- 
Kremlin Balkan publications, portrayed Montenegro as a wholly corrupt and criminal-run 
country with no law and order; Montenegro was depicted as violating the fundamental 
rights and religious freedom of the population.563 The Russian media also portrayed 
Montenegro as a country openly hostile to Russia, claiming Montenegro acted as a Western 
puppet.°°4 This campaign aimed to discredit the Montenegrin government and continue to 


increase support for the opposition to reverse the process of joining NATO. 


aE Cyber-Attacks in the Coup Attempt 


From the beginning of 2016, the Montenegrin authorities recorded a sharp increase 


in the number of cyber-attacks, targeting mainly public authorities and the media.°® For 
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example, compared to 2012, with a total of six cyber-attacks, in 2016, more than two 
hundred hacks and attacks were reported on portals, government agencies, and personal 


accounts in Montenegro.°6® 


On election day, October 16, cyber-attacks were carried out against the pro- 
government portals, such as the news site Cafe del Montenegro and “Antena M” radio’s 
website, and as well as on the site of the Socialist Democratic Party, led by then-prime 
minister Djukanovic.>°®’ These were DDoS attacks, which aimed to make web servers and 
services inaccessible to users.°©8 Reportedly the public was informed about the cyber- 
attacks, and Montenegrin national cyber security entities were taking all the measures to 
deal with these cyber-attacks.°°? Thus Montenegrin web portals reported stable 


functioning during the election time.>79 


On October 17, one day after the elections, Montenegro’s Ministry for Information 
Society and Telecommunications announced that the website of the non-government 
organization Centre for Democratic Transition, which monitored the elections, and its 


subdomains had been under cyber-attacks for five days, making it unreachable at times.57! 


Extensive cyber disruptions hit social media messaging applications, such as Viber 
and WhatsApp, which aimed to spread false information about electoral fraud and, 


therefore, intensify mass public protests against the ruling prime minister’s party.5’2 The 
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Montenegrin government appealed to the higher court and was allowed to temporarily 


block these applications for two hours on the evening of referendum day.5/3 


Following the planned coup, in February and June 2017, a GRU-affiliated hacker 
group, APT28, also known as Fancy Bear, attacked Montenegrin government agencies.>74 
Montenegrin journalists Dusica Tomovic and Maja Zivanovic refer to Christopher Bing, 
associate editor of the U.S. cybersecurity website CyberScoop, explaining that, “APT28 is 
known to target military, governmental and civil society groups that are commonly of 
interest to the Russian state.”5/> It is assumed that the APT28 may have been behind the 
October 2016 attacks on Montenegro’s targets, as similar attacks with the same footprint 


as APT28 were carried out on the day of the referendum.>76 


According to the Montenegrin cyber security authorities, the Montenegrin ministry 
of defense allegedly fell victim to cyber-attacks some time before the election day. The 
coup was planned by GRU officers and the attack on the ministry of defense was likely to 
have been motivated by military interests; therefore, it was a GRU operation as a whole, 
and it seems plausible the attacks during the referendum were also carried out by the Fancy 
Bear group, the GRU affiliate.>77 It seems that the purpose of the cyber-attacks in the coup 
was to support the coup plotters by suppressing the public’s access to information from 
government and pro-government portals in the actual coverage of events, creating 
confusion, and manipulating the public by disseminating fake news to incite more people 


to protest against the government. 


The cyber-attacks were the only activities that actually took place in the planned 
coup attempt. Despite the fact that the remaining planned activities were stopped due to 


the would-be implementers’ arrest, the attacks that did occur suggest that the cyber- 
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attackers were not in Montenegro and were not in direct contact with the coup planners. 
The absence of coordination suggests that the GRU lacked central command and control 
in the Montenegrin coup attempt. It seems that the GRU had an initial plan for a coup 
d’état, the role and tasks of non-state actors in that plan, and the desired end goal. However, 
the elements implementing the plan, cyber-attackers and armed actors, pursued an overall 
aim independently during the once-initiated activities and did not coordinate their actions 
operationally. This, in turn, highlights that once the GRU launched the seemingly 
combined series of indirect means to overthrow the Montenegrin government, it actually 


had no control over the non-state actors it exploited. 


4. Russian State Actors 


Russia has extensively used individuals associated with Russian government 


agencies. This section details the activities of these individuals in Montenegro. 


a. Eduard Shishmakov 


One of the leading planners of the coup attempt was an experienced GRU officer, 
Eduard Shishmakov. Shishmakov used the alias Eduard Shirokov as a cover identity, and 


the Russian Federation had also issued him an authentic passport with that name.>78 


Interestingly, the GRU used Shishmakov to plan and prepare for the coup in 
Montenegro, which also required going to and staying in the area of operations. 
Shishmakov had previously, in 2013, served as a deputy naval military attaché at the 
Russian embassy in Warsaw, Poland. In 2014, Poland declared him persona non-grata due 
to a spy scandal and expelled him from the country.57? Under diplomatic cover, 
Shishmakov recruited a Polish defense forces officer, a lieutenant colonel serving in the 


ministry of defense, who provided military information, and a Polish-Russian lawyer, who 
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passed financial information to the GRU.>89 The use of a fairly recently disclosed 
intelligence officer in such a sensitive operation raises questions. This shows either 
Shishmakov’s very high qualifications or, conversely, the GRU’s sloppy preparation for 
the operation. The use of Shishmakov is also likely to show the arrogance of the GRU, and 
the agency was likely confident that the operational environment would make it simple to 


conduct the operation successfully. 


b. Vladimir Moiseev 


The other leading planner of the coup was GRU lieutenant colonel or colonel 
Vladimir Moiseev.>8! From 2009, Moiseev used the cover identity of Vladimir Popov.>82 
He had previously served in the elite airborne forces, 45th Spetsnaz unit.>°83 Between 2005 
and 2009, Moiseev was assigned to the Spetsnaz unit no. 48427, which played an essential 
role in the 2008 Russian-Georgian war.584 If Moiseev was assigned to this unit before 


2008, he probably took part in the Russian-Georgian war. 


From 2009, Moiseev worked under his cover identity as Popov for the insurance 
periodical Morskoye Strakhovanie (Marine Insurance).>8° He actively traveled in Europe 
in 2012-2016 as a photographer and journalist.58© Moiseev used this cover identity in 2014 


in Moldova when he participated in the GRU’s attempt to thwart the signing of the 
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Moldova—EU association agreement in 2015, when the GRU team attempted to poison a 


Bulgarian arms dealer, and in the Montenegrin coup operation in 2016.987 


In the Moldovan case, Moiseev alias Popov, along with other GRU officers, 
prepared paramilitary units in southern Moldova to conduct similar operations to those in 
eastern Ukraine.>88 The Moldovan paramilitary proxy and auxiliary groups were trained 
and prepared at the GRU military base near the town of Aksai, Rostov-on-Don, in the 
Russian Federation.>89 As in Montenegro, the Moldovan security authorities managed to 
thwart the GRU’s activities, and Moldova’s association agreement with the EU was signed 


on June 27, 2014.590 


Moiseev was also a member of the GRU team that poisoned Bulgarian arms dealer 
Emilian Gebrev in Bulgaria in 2015.59! The GRU squad consisted of four operators, and 
Moiseev was the supporting member for the other three who poisoned Gebrev twice.>92 
Both attempts were unsuccessful, and Gebrev survived the attacks.>93 From 2014 to 2015, 


Moiseev visited Bulgaria at least five times under his cover identity.>94 
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c. GRU Covert Operations Unit 29155 


Shishmakov and Moiseev are members of a top-secret covert GRU unit, 29155.59> 
This unit includes about twenty seasoned GRU officers with combat experience in conflicts 
such as Afghanistan, Chechnya, and Ukraine, and their skills and tradecraft range from 
signal intelligence to medicine.>© This unit aims to destabilize Europe and the West’s 
unity through subversion, sabotage, and assassinations, and to covertly increase the 
Kremlin’s influence and fulfill its foreign policy goals.597 Unit 29155 was probably set up 
after 2008, but its existence and activities were unknown to Western intelligence services 


until recently.>98 


The existence of GRU unit 29155 and the activities of its covert members began to 
become apparent to Western intelligence services following successive events in Europe 
that appeared to have been carried out by a similar handwriting and related members.>9? 
Members of the unit participated in the 2014 Crimean destabilization campaign, and its 
subsequent annexation; the 2014 destabilization attempt in Moldova; the 2015 poisoning 
of Gebrev in Bulgaria; the 2016 failed coup attempt in Montenegro; and the 2018 failed 
assassination of former GRU officer Sergei Skripal and his daughter Yulia in Salisbury, 
United Kingdom.®9 In 2019, the Spanish high court opened proceedings to investigate 


whether the unit and its members were involved in attempts to destabilize and influence 
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the 2017 Catalan independence referendum.®9! The most recent example of unit 29155’s 
activities, published by the New York Times in 2020, involves bounties on American and 
coalition soldiers in Afghanistan, offered and paid to Taliban militants by the unit 
members.°2 These rewards to the Taliban for killing U.S. troops in Afghanistan represent 
a notable increase in the Russian Federation’s efforts to challenge U.S. foreign policy 


interests directly. 


5. Violent Auxiliary, Affiliate, and Criminal Proxy Actors in the Planned 
Coup 


Shishmakov and Moiseev recruited Aleksandar Sindjelic, Russia’s auxiliary leader 
in Serbia, to become the coup’s primary organizer. Sindjelic received 200,000 euros 
(245,000 U.S. dollars) in financial assistance, technical means such as encrypted cell 
phones to be distributed among coup leaders, intelligence (a detailed blueprint of the 
parliament building and its territory), and an outlined execution plan from GRU officers to 
organize the coup.©93 He agreed to cooperate with the GRU for ideological reasons, as he 


had been a committed activist in anti-Western politics for many years. 


Sindjelic’s pro-Kremlinism is reflected in his participation in the occupation of 
Crimea in 2014, where he manned the roadside checkpoints as a Serbian volunteer, and 
then fighting alongside the separatists in Donbas, eastern Ukraine, in 2015.6 Sindjelic’s 


participation in the events in Ukraine is significant for two reasons. First, there he caught 
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the eye of the GRU and also met his later recruiters, Shishmakov and Moiseev.©96 Second, 
participation in the Ukraine’s events probably led to Sindjelic becoming one of the Russian 
auxiliary leaders in Serbia, which in turn contributed to his recruitment by the GRU to 


carry out the coup. 


Sindjelic became a co-founder of the organization Serb Wolves, the Serbian branch 
of the Russian Night Wolves Motorcycle Club (NWMC).©97 As described in Chapter II, 
NWMC is the Russian-based criminal non-state entity that has become the state’s proxy 
tool uniting battle-ready diasporas abroad. Sindjelic’s cooperation with the NWMC most 
likely started in Ukraine when the NWMC supported operations in Crimea by organizing 
roadblocks, threatening Crimean officials, and assisting the Russian forces in raiding a 
Ukrainian naval base.©98 Sindjelic participated in at least one of these activities, manning 
checkpoints at the roadblocks in Crimea in 2014. Montenegrin journalist Tomovic refers 
to a Ukrainian source, which claims that Sindjelic chose Serbian “volunteers” as members 
of the Serb Wolves, the NWMC branch in Serbia, who also had experience with Russia’s 
activities in Ukraine.©9 The Serb Wolves led by Sindjelic became a local Russian auxiliary 
group to influence the Balkans’ events in Russia’s favor. Members of both the Serb Wolves 


and the NWMC were to take part in the planned coup in Montenegro.®!0 


The Serb Wolves is an auxiliary group because their pro-Kremlin mindset and the 
primary motivation for anti-Western action seem to be mostly ideological. Their leader, 
Sindjelic, received money from the GRU, but it was not used to motivate members but to 
prepare for a coup in Montenegro, such as acquiring weapons from Kosovo.®!! The Serb 


Wolves is a group inspired by Serbian extremist nationalism, amplified by Russian- 
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emphasized pan-Slavic ideology. Russian tactics to stress Serbian nationalism through pan- 
Slavism is purposeful because “extreme Serb nationalism, coupled with its vision of 
Greater Serbia (the unification of all ethnic Serbs into one state), creates fertile grounds for 


recruitment to Russian-backed political and paramilitary activities.”6!2 


Sindjelic was also a member of another, Montenegrin-based, paramilitary group 
Balkan Cossacks Army (BCA), affiliated with the NWMC.®!3 BCA is a pro-Kremlin 
organization that brings together veteran-volunteers from recent Russian wars and 
conflicts, such as eastern Ukraine, and its mission is to reject the imposition of foreign 
values in the Balkans and promote pan-Slavism.©!4 The leader of this organization is a 
Russian citizen and a self-proclaimed Cossack General Viktor Zaplatin.©!5 He is a Soviet 
army veteran of numerous armed conflicts, and Serbia’s pro-Russian press describes him 
as “the official representative of the Union of Volunteers, which is directly associated with 
Vladimir Putin.”6!6 He coordinates the activities of so-called Russian volunteers in the 
Balkans under the direct supervision of Aleksandr Boroday, a Russian citizen who was part 
of the planning circle for the occupation of Crimea and incited the separatist conflict in 
eastern Ukraine.®!7 Boroday’s activities in Ukraine were funded, supported, and directed 
by Konstantin Malofeev, the same Russian oligarch who was probably one of the authors 


of the idea of a coup in Montenegro. 


The Cossack community and pro-Kremlin volunteer groups, often attached to the 
Cossacks, are the Russian affiliate forces that Russia uses abroad in PMC-like roles.618 
Domestically, in Russia, Cossacks are used as an auxiliary element. In 2005, President 


Putin signed the law “On the State Service of the Russian Cossacks,” and since then, the 
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prominent part of the Cossacks has been the patriotic and Orthodox tutoring of young 
people in Russia.©!9 Moreover, the Russian Cossack community regard themselves as the 
“carrier of conservative Orthodox values, fighting with the degenerate West and Islamic 
fundamentalism,” and their role as an internal security auxiliary force has expanded.629 
Except for the struggle in eastern Ukraine, where they have been involved in armed 


activities, the Cossacks are largely used for soft-power influencing outside Russia.°?! 


The ceremonial founding of the BCA in the Montenegrin town of Kotor, which 
took place a few months before the coup attempt, was led by Serbian Orthodox priest 
Momchilo Krivokapic and several members of the NWMC.®22 The activities of the Serbian 
Orthodox Church and the NWMC in supporting pro-Kremlin auxiliary and proxy groups 
are often mutually supportive and complementary.©23 Russian Cossacks fighting alongside 
the separatists in eastern Ukraine also attended the Kotor ceremony and conveyed 


Boroday’s greetings.o24 


The direct role of the BCA as an organization in the planned coup is unknown or 
unclear.62> As the coup was going to involve nearly five hundred participants, it is possible 
that some BCA members were recruited or planned to attend the event. Yet, since the BCA 
was established a few months before Montenegro’s elections, it is possible that BCA’s 
intended role may have been to participate in the post-coup events and to help to stabilize 
Montenegro and lend support in turning the political environment in directions favorable 


to Russia. 
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Sindjelic hired another member of the BCA, former Serbian special police chief 
Bratislav Dikic, to lead and organize the Montenegrin coup’s armed activities.©2© Dikic’s 
job was to lead agents disguised as police officers to infiltrate the parliament building, 
shoot the protesters, assassinate the Montenegrin prime minister, and keep the building 
under control for forty-eight hours.27 Dikic can be considered a proxy actor because his 
primary motivation to join in the plot was money. He received 15,000 euros (18,400 U.S. 


dollars) from the GRU through Sindjelic to participate in the coup.628 


On the night of October 15, while arrests of the coup plotters were underway, the 
Montenegrin security agency reportedly received information from Serbia’s Security 
Intelligence Agency that fifty GRU Spetsnaz operators had entered Montenegro’s 
mountainous Zlatibor region from Serbia.o29 Their first task was to destroy a nearby 
Montenegrin special forces compound to prevent the unit from intervening in the events in 
the capital, Podgorica.®39 The Spetsnaz unit then had to move to Podgorica to support 
Dikic’s operations in possible post-election confrontations.3! Through encrypted phones, 
this Spetsnaz unit had allegedly been waiting for confirming information from the 
Opposition politician and coup plotter KneZevic to start the mission but was forced to abort 
the operation since KneZevié never contacted them.®32 Montenegrin authorities believe 


that the GRU specialized group exited Montenegro via neighboring countries.933 


The key person leading to the failure of the coup attempt was Montenegrin national 


Mirko Velimirovic. After being recruited, Sindjelic received money and instructions from 
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GRU officers in Moscow to prepare for and carry out the coup.934 Returning from 
Moscow, Sindjelic contacted and recruited Velimirovic, whose tasks were to obtain 
weaponry from Kosovo, recruit additional people to participate in the coup, and rent a 
house in the Montenegrin capital, Podgorica, to be used for storage and as a safe house.®35 
It is unclear whether Velimirovic was initially a Montenegrin police collaborator or 
whether he broke under pressure in the run-up to the coup and became a police informant. 
Through Velimirovic, the main organizers and leaders of the coup’s armed activity, 
Sindjelic and Dikic, were captured and arrested, which prevented the plot from 


materializing.636 


E. CONCLUSION 


As noted previously, Russia considers the Balkan region to be its sphere of 
influence. To consolidate and increase its influence in the region, Russia relies mainly on 
pan-Slavism and Orthodox Christianity. It emphasizes the unity, historical ties, and values 
of the Slavic peoples and the need to unite Slavs regardless of state borders and 
geographical location. Through ethnic proximity and religious values, Russia presents 
itself as a region’s guardian against the so-called hostile and malign West’s influence. 
Hence, Russia saw Montenegro’s accession to NATO as a serious threat to maintaining its 
power in the region. Also, despite the initial setback, Russia hoped to gain friendly access 
to the Mediterranean through Montenegro, which became impossible with Montenegro’s 


accession to NATO. 


The leading planners of the 2016 Montenegrin coup were two GRU officers, 
Eduard Shishmakov and Vladimir Moiseev, who belonged to the GRU’s top-secret covert 
unit 29155. Members of this unit have been involved or suspected of participating in 
several covert operations in Europe since 2014, such as the assassination attempt of former 


GRU officer Sergey Skripal and his daughter in Salisbury, UK. Interestingly, despite the 
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unit’s likely high level of professionalism and experienced members, its known operations 
in Europe have all failed.©37 For the coup in Montenegro, Shishmakov and Moiseev 
recruited Serbian criminal and nationalist Aleksandar Sindjelic, who had previously taken 
part as a Serbian volunteer in the annexation of Crimea and hostilities in eastern Ukraine. 
Although Sindjelic became the main organizer, responsible for arranging the rest of the 
local participants’ recruitment and preparations for the coup, the plan and funding came 


through the Shishmakov and Moiseev from the GRU. 


The coup plan called for the recruitment of up to 500 participants, most of whom 
were primarily members of local pro-Kremlin auxiliary and proxy organizations and had 
experience in fighting in Ukraine. On election day, October 16, 2016, when the 
Montenegrin government voted about joining NATO, the plotters planned an anti- 
government demonstration in front of the parliament building. The plan was to escalate the 
demonstration into violent protest and, under its cover, invade the parliament building, 
assassinate then-prime minister Milo Djukanovic, and transfer power to Montenegro’s pro- 
Kremlin political opposition. The opposition, the Democratic Front, would have changed 


Montenegro’s foreign policy course and suspended its accession to NATO. 


The coup failed because one of the key organizers, Montenegrin Mirko 
Velimirovic, became an informant for the Montenegrin police, and other essential 
organizers and perpetrators were arrested through him before the coup attempt. The leading 
planners and sponsors of the coup, GRU officers Shishmakov and Moiseev, managed to 


avoid the arrest and escape through neighboring Serbia. 


The GRU’s planned coup in Montenegro failed because there was one weak link in 
the plan and preparations, which was Velimirovic. Therefore, the whole Russian NTW 
campaign in Montenegro was a failure, and Montenegro joined NATO in 2017. The author 
does not know whether Velimirovic became a police informant during the coup’s 


preparations or whether he was a police collaborator from the beginning and the coup was 
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compromised from the start. Had the Montenegrin police not been aware of the coup plan 


through Velimirovic in time, however, the coup could have succeeded. 


It seems to the author that sufficient preparations had been made for a possible 
successful coup because the activities among the various armed auxiliary, affiliate, and 
proxy groups to conduct the operations and stabilize the post-coup situation were 


coordinated. 


The Montenegrin coup was also to be supported by cyber-attacks, probably carried 
out by the GRU affiliated APT28. The cyber-attacks were likely intended to cause 
additional confusion, encourage more people to participate in the protests, exhaust 
Montenegro’s resilience, and thus, support the coup. It seems to the author that there was 
a lack of cooperation and coordination between cyber-attackers and violent groups 
responsible for attacking the parliament house. The lack of collaboration is indicated by 
the fact that, despite the arrest of coup plotters and the failure of the coup attempt, cyber- 
attacks nevertheless took place. This, in turn, suggests that the GRU had no control over 


the various elements intended to carry out the coup as a whole. 


Based on Montenegro’s example, the author concludes that once the GRU has a 
plan and a goal in place, the various non-state actors follow the general objective, and they 


are autonomous in their activities. 
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Vv. CONCLUSION 


The thesis examined two in-depth case studies to map Russia’s use of non-state 
actors to achieve its foreign policy goals in its “near abroad” and in a region that Russia 
considers its sphere of influence, and to assess Russia’s success in using these non-state 
actors. More precisely, the research examined the central proposition of the thesis that 
Russia’s activities using non-state actors are more efficient and effective in an environment 
close to Russia geographically, with historical ties and cultural similarities and convenient 
preconditions for action. The research examined this proposition in terms of one case of 
geographical proximity (Estonia) and one case of cultural and religious proximity 
(Montenegro) to Russia. In both cases, the research revealed that, contrary to the 
proposition that assumed success, Russia’s strategy of using non-state actors to achieve its 
foreign policy goals failed. This outcome partially refutes the central proposal. 
Nonetheless, in both cases, Russia managed to provoke or instigate internal conflicts in the 
target countries through the use of influencing campaigns and non-state actors precisely 
for reasons suggested by the proposition—historical ties, cultural similarities, and 


convenient preconditions for action. 


The reasons for the failure of Russia’s strategies in Estonia and Montenegro were 
different, and they were instead caused by insufficient or failed preparations and planning. 
In the first case, it seems that Russia focused mainly on creating a conflict in Estonia, but 
there was no follow-up plan on how to proceed after its start. Therefore, it can be said that 
Russia used the favorable opportunity to test its ability to use non-state actors against the 
state in NATO and the EU. In addition, as Chapter II describes Russia’s goals to use every 
possibility to weaken the West, there was a potential opportunity for Moscow to exhaust 
its opponent in Russia’s “near abroad” and also fragment European unity. In the case of 
Montenegro, Russia managed to pave the way for a successful NTW campaign under the 
conditions set out in the central proposal of the thesis. Unlike the case in Estonia, there was 
also a follow-up plan to achieve the goal with non-state actors and prevent Montenegro 


from joining NATO or at least postponing the process. The failure was caused by a weak 
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link in the plan, without which it is possible that the coup attempt in Montenegro could 


have succeeded. 


A. THE PATTERN OF RUSSIA’S NTW CAMPAIGNS AND THE USE OF 
NON-STATE ACTORS 


As this thesis has shown, the prerequisite for starting a Russian NTW campaign is 
the psychological influencing of the target country’s population and government to create, 


maintain, and amplify divisions in the target state’s society. 


1. Creating the Preconditions for an NT'W Campaign 


One essential channel of influence in the Russian NTW to divide and manipulate 
the target country’s society is the media. The Russian media is mainly state-controlled, and 
it played an essential role in both case studies. In Estonia’s case, the vast majority of 
Estonian Russians consume either Russian media channels directly or media created and 
directed from Russia to the Baltic Russians. A similar situation exists in the Balkans, where 
many Montenegro and Serbia media outlets and websites are taking information directly 


from Russian media sources.§38 


Based on both case studies, it can be seen that the three main goals that the Russian 
media and local Russian-linked media channels are trying to achieve with propaganda and 


information manipulation in the target country are: 


e To obstruct the integration of the target country’s society. To this end, the 
Russian-linked media attempts to contrast, differentiate, and create 
contradictions among the various nationalities living in the target country. 
In Estonia’s case, the biased media portrays Estonian Russians as being 
subjected to ethnic inequality, harassment, and humiliation. In the case of 
Montenegro, the directional media emphasizes pan-Slavism, Slavic pride 


and independence, and Slavic opposition to the demoralized West. This 
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strategy creates a situation where anyone who is not Slavic or does not 


support pan-Slavism can be portrayed as an opponent. 


To display the target as a weak and law-breaking state, hostile to Russia. 
In Estonia’s case, the Russian media promotes the view that after the 
collapse of the Soviet Union and accession to the West, Estonia has 
become a poor, demoralized, and declining country. In Montenegro’s case, 
through the Russian media, Montenegro is portrayed as a traitor that has 


turned its back on traditional values and has become a Western puppet. 


To ridicule Western culture and values and portray Western influence as 
hostile and aggressive. This is evident in the negative portrayal of NATO, 
the EU, and other Western organizations by Russian media or media outlet 
linked to Russia. For example, such a narrative maintains that NATO only 
causes trouble with its provocative behavior, and in reality, the ordinary 
people of the target country suffer. Further, the narrative argues that the 
target state’s government is to blame, and the people should not trust their 
government because of the state’s membership in NATO and other 


Western organizations. 


Although the Bronze Soldier case took place in 2007 and the Montenegrin coup 


attempt almost ten years later in 2016, the Russian influencing strategy’s build-up was 


similar in both instances. In addition to broader media activities, the Russian leadership 


directed a dedicated central body under the direct control of the government to coordinate 


and control the influencing of the target state’s population and government locally. 


A Central Body with a Direct Link to the Russian Leadership 


In both studies, a state-controlled central body emerged, which could operate, for 


example, under the cover of a cultural or strategic research center. The central body’s tasks, 


subordinated to or directly linked to Kremlin, are to coordinate, support and, if necessary, 


direct the activities of influence agents and influence organizations operating in the target 
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country or region. This central body can cooperate with Russian intelligence and security 


agencies in recruiting and directing influence agents to fulfill its role. 


In Estonia’s case, this central body is the DIRCCFC (Directorate for Interregional 
Relations and Cultural Contacts with Foreign Countries), which reports directly to the 
president’s administration. In the case of Montenegro, the central body is Serbian-based 
RISS (Russian Institute for Strategic Studies), directly controlled by the Kremlin. The SVR 


generals head both organizations. 


Despite these similarities, the case studies revealed a difference in the location of 
the body that manages and coordinates influencing activities. In Estonia’s case, since the 
DIRCCFC covers former Soviet member states in Russia’s vicinity or its “near abroad,” 
the central body is located in the Russian Federation. In the case of geographically remote 
regions that Russia considers to be in its sphere of influence or wishes to control, this 


central body, according to Montenegro’s case, is located in the region of interest. 


3. Influence Organizations and Influence Agents Managed and 
Coordinated by the Central Body 


In Estonia’s case, the study revealed that the DIRCCFC manages and coordinates 
various NGOs’ activities through covert direct links. NGOs, in turn, can be led by 
individuals associated with Russian special services or their former officers. The HMF 
(Historical Memory Foundation), brought as an example in the study, is headed by an 


individual related to the FSB. 


NGOs present themselves as credible organizations that carry out seemingly serious 
research and base their analyses on scientific or academic foundations. By manipulating 
information, they aim to prove to the international community and the Russian target group, 
both in the target country and at home, that the target country violates not only human 
rights but the law and does not fit into the international community. To carry out their tasks, 
these NGOs work with various journalists, historians, academics, and politicians and, in 


turn, use smaller non-profit organizations. 


Secondly, these central bodies direct and coordinate influence agents in the region 
and the target country (Estonia and the Baltics, and Montenegro and the Balkans). In the 
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example of Estonia, there were Russian journalists dedicated to influencing, specifically 
Zorina and Sapozhnikova. These journalists’ main task seemed to be to spread anti- 
Estonian propaganda and fake news and sow distrust between Estonians and Estonian 
Russians. To this end, for the media created for the Russian-speaking population in Estonia 
and the Baltics, these Russian journalists produced torn-out-of-context or manipulated 
information, fake news and, if necessary, even staged events to convey the desired 
message. Also, both journalists coordinated their actions with pro-Kremlin auxiliary and 
proxy organizations. Zorina, who organized influencing activities against Estonia mainly 
from Russia, cooperated with the Russian-based youth organization Nashi, and 
Sapozhnikova, who was primarily active in Estonia, collaborated with the local Night 


Watch organization. 


Based on a study on Montenegro, RISS coordinated and supported the main anti- 
NATO and anti-Western agents in the region. These agents included Amfilohije Radovic, 
the archbishop of the influential Serbian Orthodox Church in the region, Andrija Mandi¢ 
and Milan KneZevic, leaders of the Montenegrin political opposition, and Konstantin 
Malofeev, a Russian oligarch in direct contact with RISS. Mandi¢, KneZevic, and Radovic, 
in turn, were divided into separate, political and religious influence agents, which the 


author describes in more detail in the next section of this chapter. 


Influence agents may also have additional roles to play. In addition to influencing, 
agents can also act as so-called talent seekers looking for people in the target country or 
region who could be recruited as influence agents or whose recruitment or cooperation 
could otherwise benefit Russia in fulfilling its goals. In Estonia’s example, journalist 
Sapozhnikova forwarded the DIRCCFC a list of “Promising Estonian People” that 
included Estonian politicians’ and journalists’ names. The Montenegrin case study showed 
that RISS director Reshetnikov and Malofeev suggested, probably to the GRU, the 


individuals in the Balkans, whom they recommended to recruit in carrying out the coup. 


In Malofeev’s example, the agent of influence may be a wealthy Russian 
businessman or an oligarch with seemingly personal business interests in the target country 
or region. The Russian oligarchs have gained their wealth thanks to the fact that the Russian 


leadership, led by President Putin, has made it possible for them. The price of this wealth 
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is to support and obey the leadership of the Russian state. In the target country, therefore, 
wealthy Russian civilians, seemingly not connected to the Russian state, stand for their 
business interests and beliefs, but they also clandestinely serve Russia’s foreign policy 
goals. In Malofeev’s example, he communicated with the Russian leadership through RISS 
and his role seemed to be to support, coordinate, and possibly fund local influence agents 


and other actors who supported Russia’s aims. 


4. Political and Religious Influence Agents 


Based on the case studies, it seems essential for Russia to create a political influence 
agent supporting Russian policies in the target country or region, who could, at least 
ostensibly, intervene in the local political landscape to confront and create confusion and 
contradictions. It also seems important for Russia to recruit an agent in an area that plays 
an essential and influential role in the target state’s society and can emotionally affect the 
members of the community; such an area is religion. These influence agents are either run 
directly from Russia, which often leads to the agent traveling to Russia or meeting with 
Russian representatives in third countries, for example, at various conferences and events. 
While in the target state, the Russian embassy or intelligence agencies’ staff coordinates 


the agents’ activities. 


In the case of Estonia, the leading political influence agent was Andrei Zarenkov. 
He created the facade organization Constitutional Party, funded and supported by the 
Russian embassy in Tallinn, various Moscow city government agencies, the Russian 
media, and contact persons in the Russian special services.939 Zarenkov met with Russian 
representatives both in Russia and with embassy staff in Estonia.©40 Also, Dmitriy Linter 
and Dmitriy Klenskiy, who had a political background in Estonia, became leaders of the 


pro-Kremlin auxiliary organization the Night Watch.®4! The author describes the Night 
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Watch and the role of auxiliary organizations in NTW in more detail in this chapter’s next 


section. 


However, Linter and Klenskiy are further examples of how influence agents can 
play additional roles or how their role can be enhanced as events unfold. Of the two, Linter 
often traveled to Russia and met with embassy staff in Estonia.42 Although Zarenkov did 
not participate directly in the Bronze Soldier riots, Zarenkov and Linter coordinated their 


activities before the Bronze Soldier events in Estonia.©43 


In Montenegro, the political agents were Mandi¢ and KneZevic, leaders of the 
Democratic Front of the Russian pro-Russian political opposition. These politicians had 
active and direct connections to President Putin’s United Party of Russia, and they met 


several times and held talks with senior officials of that party. 


Religion does not play a primary role in Estonian society and cultural space, and 
probably, therefore, there was no leading religious influence agent in Estonia. In 
Montenegro and Serbia, where the Serbian Orthodox Church is prominent and influential, 
the archbishop Radovic was the spiritual influence agent. Radovic tried to promote anti- 
Westernism and prevent Montenegro from joining NATO by emphasizing local religious 
values. Moreover, Radovic had ties to the Russian Orthodox Church, which is closely 
linked to Russia’s special services. In Montenegro, Radovié cooperated and coordinated 
his actions with Mandi¢ and KneZevic, political agents, as well as Reshetnikov, director of 


RISS, and oligarch Konstantin Malofeev, Russia’s local agent. 


Therefore, the study shows that there was more room for influence and action for 
Slavophile Russian non-state organizations in Montenegro to have a role than in Estonia, 
where roughly 80 percent of the population is not Orthodox Christian.644 Therefore, in 


environments where there is a considerable Slavic and Eastern Orthodox community, 
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Russia has additional assets compared to countries where they do not exist, are in a 


significant minority, or have minimal influence. 


The study also shows that all these influence agents in the Balkans had a direct link 
with Russia, but the so-called daily activities in the region were probably coordinated and 


mediated by RISS director Reshetnikov and Malofeev. 


5. Violent Non-State Actors 


After preparing the ground through influencing activities, Russia’s NTW strategy 
seems to focus on the existence of a local pro-Kremlin or at least anti-governmental group 
operating in the target country, and such a group should have overlapping goals with those 
of Russia. The purpose of a violent local group or groups is to directly oppose the 
government of the target state and participate in culminating events such as the Bronze 
Soldier street riots and the coup in Montenegro, which require some form of violent or 
armed action. The author assesses that the local violent groups are necessary to publicly 
portray the confrontation as a local problem and distance Russia’s direct involvement in 


the conflict. 


Based on the examples in Estonia and Montenegro, it seems that Russian entities 
are recruiting a key person locally who will have direct contact with the Russian authorities 
and whose task is to form that local violent organization that supports Russia’s goals. 
Estonia’s and Montenegro’s cases also show that the local pro-Russian auxiliary or proxy 


organization will be supported by a similar organization from Russia. 


The author assesses that the Estonian pro-Kremlin auxiliary group, the Night 
Watch, did not become a violent group that could directly threaten Estonia’s security 
because the political influence agent Linter, who formed it, could not recruit or involve 
enough dedicated members. Nonetheless, the Night Watch contributed to provoking the 
Bronze Soldier riots. Thus, in Estonia’s case, as a result, the Night Watch did not become 


a violent group, but, like their leader Linter, instead became an influence group. 


As influencers, Linter and the Night Watch collaborated with a similar organization 


in Russia, the pro-Kremlin youth organization Nashi. Nashi’s leader in Estonia, Mark 
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Siryk, collaborated in Estonia with Linter and helped organize the Night Watch’s activities. 
Also, Nashi leaders in Russia wanted to support the Night Watch’s activities in provoking 
the Bronze Soldier incident and also during street riots. As described earlier, Russian 
journalists Sapozhnikova and Zorina also coordinated their activities and collaborated with 


the Night Watch and Nashi. 


The Montenegrin case study shows that the GRU recruited a Serb nationalist, 
Aleksandar Sindjelic, to organize the coup. Sindjelic formed the violent local pro-Kremlin 
organization the Serb Wolves after returning from hostilities in Ukraine, where he had 
come into contact with both the GRU and the Russian organized crime group NWMC. 
Therefore, the author assesses that it is probable that Sindjelic was, in fact, recruited by the 
GRU to carry out possible future NTW operations in the Balkans, not just before the 
Montenegrin coup, but already in Ukraine. Returning from Ukraine, he formed a branch of 
the NWMC in Serbia, to which he recruited local Balkans, mostly Serbs, who also had 


taken part in hostilities in Ukraine. 


A Russian equivalent, the NWMC directly supported the activities of Sindjelic and 
the Serb Wolves in Montenegro and Serbia. In addition to backing the Serb Wolves, the 
NWMC assisted and participated in establishing another violent organization in 
Montenegro, the BCA (the Balkan Cossack Army). The creation of the BCA seems to have 
been Russia’s preparations for the post-coup era in Montenegro. Thus, it seems that the 
BCA’s main task was to become one of the actors to stabilize the post-coup environment 


and to shape it in line with Russia’s goals. 


The BCA is still led by two former Russian military personnel who were also 
involved as “volunteers” in conflicts such as in eastern Ukraine, in Transnistria in Moldova, 
and in Abkhazia in Georgia.®*> The organization has close links with its Russian Cossack 
counterparts.®46 At least before the coup attempt, BCA was also known to be associated 


with so-called Russian volunteers. This BCA concept seems to support a similar pattern to 
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the events in Ukraine after 2014. If the coup in Montenegro had been successful, the alleged 
protection and preservation of the Slavs’ rights would probably have become even more of 
a priority. Consequently, a “guarding and protective” organization, such as the BCA, led 
by former Russian military personnel and composed of Russian volunteers and “brothers 
in arms” to support the fraternal peoples, other Slavs in defending their rights and values, 


would have been pertinent. 


Thus, the author estimates that the Serb Wolves, the NWMC, and the BCA formed 
a system of violent auxiliary and proxy organizations in Montenegro. Armed groups, 
probably composed mainly of the Serb Wolves members, were tasked with carrying out 
the coup. In the ensuing period, Sindjelic and the Serb Wolves would have been joined by 
BCA. The preparations and activities of both organizations were supported, coordinated, 


and possibly controlled by the NWMC, which in turn is coordinated by the GRU. 


The location of various influence agents and organizations and other non-state 
actors in the network of the NTW campaign build-up, their contacts with Russian 


authorities and entities, and their cooperation are illustrated in Figure 2. 
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Figure 2. _ Location of influence agents and other non-state actors in the NTW 
campaign, contacts with Russian authorities, and mutual cooperation. 


6. Cyber Operations 


Russia is the main security threat to Western democracies in cyberspace.®47 Much 
of Russia’s cyber activity is related to intelligence, which is increasingly complemented by 
the use of cyberspace for influencing, and if combined, aims to “divide Western societies, 


transnational relations, and NATO.”648 


Here are the four main methods that Russian special services are actively using 


against Russian opponents: 


e Hacking into a media outlet’s website and adding news with pro-Kremlin 
narratives, from where this news link is distributed in other media, later 


also in Russian media, blogs, forums, and elsewhere. In 2020, this method 





647 Estonian Foreign Intelligence Service, Eesti Rahvusvahelises Julgeolekukeskkonnas 2021 
[International Security and Estonia 2021] (Tallinn, Estonia: EFIS, 2021), 65, 
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was used several times in Lithuania and Poland to spread fake news about 


NATO and its forces.649 


e Russia’s special services disseminate stolen information from cyber- 
attacks that has been torn-out-of-context and could exacerbate 
disagreements on sensitive societal issues and help provoke protests. In 
2019, Russia used this method against the United States and the UK ona 


trade negotiations topic.®59 


e Russian special services organize DoS attacks on the media and 
government sector, which, among other things, hinder the flow of official 
information. The aim is to show Russia as a threatening force, create 
confusion, sow fear, and force the target country to make decisions 
favorable to Russia. Russia used this method in Estonia in 2007 and 


Montenegro in 2016.°°! 


e Russian special services break into a website and add photos, text, video, 
or audio with frightening, threatening, or socially disturbing content. The 
aim is to prevent the flow of truthful information, create fear in society, 
deepen internal tensions, or undermine government agencies’ credibility. 
Russia used this method in 2019 in Georgia, when GRU hackers broke 
into the web service provider’s information system, through which they 
defaced thousands of websites, adding a photo of former president in exile 


Mikhail Saakashvili with the text “I’m coming back.”652 


Thus, Russian cyber activity seems like a separate branch of the NTW, which 
constantly looks independently for opportunities and weaknesses to disrupt the entire West 


or governments deemed unfriendly to Russia. It seems that Russian special services see 





649 Estonian Foreign Intelligence Service, International Security and Estonia 2021, 67. 
650 Estonian Foreign Intelligence Service, 67. 
651 Estonian Foreign Intelligence Service, 68. 


652 Estonian Foreign Intelligence Service, 68. 
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cyber-attacks as a tool to complement other NTW activities, but they are started and used 
as separate tools of NTW. The author assesses that, if Russia sees that as a result of general 
anti-Western subversion, there is an opportunity to use NTW to directly weaken some 
member state, such as Estonia, or the need to launch a targeted anti-state campaign, such 
as in Montenegro, the cyber sector, which is carrying out broader and comprehensive NTW 


activities against the West anyway, will be involved in supporting these campaigns. 


Based on the examples of Estonia and Montenegro, the author assesses that the 
cyber-attacks seem to be a separate part of both NTW campaigns, which were implemented 
or planned to be implemented simultaneously with other NTW activities, such as street 


riots or an attack on the parliament building, but were not coordinated with other actions. 


Cyber-attacks began almost simultaneously with the street riots in Estonia but 
continued in various waves for nearly three weeks after the street riots were suppressed. 
As this was the first time that combined cyber-attacks were used against a state, the aim 
likely was to test a so-called new method to find out how cyber-attacks can be used, what 
damage they cause, and what can be achieved in its entirety by cyber-attacks in this massive 
form. In Montenegro’s case, the cyber-attacks were the only NTW activities that actually 
happened. This activity suggests a lack of communication and coordination, which, in turn, 
indicates that the cyber-attacks were an independent part of the NTW and that the GRU 
probably lacked control over the elements of the NTW. Still, as the cyber-attacks were 
probably intended as a supporting element to the canceled primary action, as separately 


conducted attacks, they did not have a significant impact on Montenegro’s security. 


B. THE CASES OF CATALONIA’S INDEPENDENCE REFERENDUM AND 
NORTH MACEDONIA’S PATH TO NATO 


In support of the conclusions drawn from the case studies, the author presents in 
brief two additional examples of how Russia uses media, influence agents, and 
organizations as the basis of its NTW build-up. The first example is the Catalan 
independence referendum in Spain in 2017, when, like in Estonia in 2007, Russia interfered 


in the internal matters of a NATO and the EU member-state. The second example, which 
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focuses on North Macedonia, shows how Russia tried to obstruct another Balkan state like 


Montenegro from moving towards the West and joining NATO. 


ii Catalan Independence Referendum in 2017 


Catalonia’s independence referendum in 2017, by which the Spanish autonomous 
region of Catalonia wanted to secede from the rest of Spain, is another example of how the 
Russian Federation took a favorable opportunity to amplify an internal conflict ina NATO 
and EU member-state. In doing so, Russia’s main goal was probably to weaken and divide 
the West and its organizations.®>3 The Spanish government declared the referendum illegal 


and suspended the region’s attempt for independence.®>4 


The Spanish Supreme Court accused Russia of an information war in which Russia, 
by spreading fake news and manipulating information, tried to create and amplify social 
divisions in Catalonia and thus encourage Catalans to participate in the independence 
referendum.®>> Based on the case studies analyzed in the thesis, the author concludes that 
the Russian NTW campaign’s primary activity is to psychologically influence the target 
country’s population to create divisions in the population and then amplify them. 
Successful influencing, after which the population of the target country is divided and 
conflicted, is the basis and creates the preconditions for the use of other elements of NTW, 
such as violent auxiliary and proxy non-state actors. Thus, Russia’s NTW concept used in 


Spain was similar its approach in Estonia and Montenegro. 


Russia’s influencing strategy in support of the Catalan referendum was mainly 
divided into two—the use of the media and activities supporting it on social media. 
Russia’s state-controlled media outlets, such as RT (Russia Today) and its sister service 


Sputnik, massively spread the news with manipulated content or outright fake news. For 
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example, RT “[was] using its Spanish-language portal to spread stories on the Catalan crisis 


with a bias against constitutional legality.”656 


Also, it seems that Julian Assange, the founder of Wikileaks, acted as Russia’s 
influence agent because he “[became] the principal international agitator in the Catalan 
crisis, sharing opinions and half-truths as if they were news.”©57 In addition, “automated 
“bots,” including Russian propaganda ones, amplified tweets by Assange and former 
United States National Security Agency (NSA) contractor-turned-leaker Edward 
Snowden,’”’658 and “pro-Kremlin websites including Disobedient Media, News-Front, and 


Russia News Now spread fake or biased news about the situation in Catalonia.”©5? 


Members of the Spanish government accused unspecified Russian government 
agencies and private entities of massively disseminating and amplifying Catalan pro- 
separatist messages through fake social media accounts on platforms such as Facebook and 
Twitter, to influence public opinion.®°° The author estimates that these unspecified state 
agencies were Russian special services and private sector entities were Russian 
cybercriminals used by special services. The author’s assessment is based on the modus 
operandi of Russian special services and cybercriminals described in Chapter II and the 
similarities of the cyber activities analyzed in the case studies. Also, nearly 30 percent of 
fake social media accounts originated in Venezuela.°°! This further refers to the 
involvement of Russian special services, as Russia is also closely involved in Venezuela 


and has, among other things, deployed GRU special and cyber units there. 
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In addition to exploiting the news media and social media, Russia used powerful 
Catalan businessmen as agents of influence. Spanish police arrested several Catalan 
businessmen after the referendum failed, at least three of whom had contacts with 
Russia.©63 One of those arrested with Russian contacts was “a former member of the 
Catalan government and ex-member of the dissolved terrorist group Terra Lliure.”©°4 The 
second with contacts was related to Russia’s campaign of influence in the media, and the 
third had contacts with an unspecified Russian group, which promised to support 
Catalonia’s regional President Carles Puigdemont with 10,000 troops, if necessary, in a 


referendum’ s framework.®®5 


2. North Macedonia’s Path to NATO 


North Macedonia (previously Former Yugoslav Republic of Macedonia — 
FYROM) is located, like Montenegro, in the Western Balkans.©°° As the case study of 
Montenegro showed, “the Western Balkans are part and parcel of Russia’s strategy to 
establish itself as a first-rate player in European security affairs, along with other major 
states such as Germany, France, and the UK,’ and “the region has always been of 
strategic significance, standing between Western Europe, Russia and the Middle East, and 


in the center of the debate for NATO and EU enlargement.”668 
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North Macedonia joined NATO on March 27, 2020.99 Before that, however, 
Macedonia was ruled by an authoritarian regime led by a nationalist prime minister, Nikola 
Gruevski, from 2006 to 2016.679 The pro-Russian FYROM prime minister led the country 
into conflicts with neighboring countries such as Greece, and his nationalist regime created 
divisions between the country’s Christian and Albanian Muslim communities.©7! In the 
2016 general elections, however, the FYROM political opposition succeeded in 


overthrowing the Gruevski government, and the country set its course towards the West.972 


The main obstacle to joining the West was FYROM’s conflict with Greece over the 
country’s name.°73 Because of the region of Macedonia in Greece, the Greeks feared that 
FYROM might have grounds for territorial claims against Greece.’ For this reason, 
Greece hindered FYROM’s efforts to join Western organizations such as NATO and the 
EU.®75 The dispute was resolved between FYROM and Greece in 2018 with the Prespa 


Agreement, paving the way for FYROM to become the Republic of North Macedonia.®76 


As in Montenegro, Russia used influence agents in its attempts to prevent North 
Macedonia from moving to the West and joining Western organizations such as NATO. 
Russia tried to suspend the Prespa Agreement by using a Russian-Greek businessman, Ivan 
Savvidis, whom the prime minister of North Macedonia “accused of paying far-right 
Macedonian nationalists and soccer hooligans, as well as the Greek clergy and government 


officials, to stoke opposition to the Prespa Agreement.”677 “In June 2018, after violent 
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demonstrations erupted in Skopje against the agreement, investigative reporters uncovered 
evidence that Savvidis provided at least 300,000 EUR to foment opposition to the deal, 
including a social media campaign aimed at stemming turnout for the September name- 
change referendum.”6’8 The soccer hooligans participating in demonstrations were 
supporters of the soccer club owned by another Russian oligarch residing in Skopje, the 


Macedonian capital.679 


As it was in Montenegro, the GRU was active in North Macedonia. GRU officer 
Vladislav Filippov, a military attaché at the Russian embassy in Bosnia and Herzegovina, 
recruited Serbian intelligence officer Goran Zivaljevic.89 These two intelligence officers’ 
main task was to coordinate and direct the activities of influencing agents in Macedonia. 
Filippov and Zivaljevic mediated contacts between Moscow and the leader of the 
Democratic Party of Serbs in Macedonia.°8! These Russian and Serbian intelligence 
officers also supported the influence agent Savvidis and helped prepare for violent protests 
sponsored by the latter in the Macedonian name change process.®82 Third, Filippov and 
Zivaljevic collaborated with Miroslav Lazanski, a self-appointed journalist for the local 
Russian media channel Sputnik, whom the North Macedonian counterintelligence service 


considered “as one of the main pro-Kremlin propagandists in the country.”©83 


Another leading media-related Russian influence agent in North Macedonia was, 
and still is, freelance journalist Krum Velkov. In addition to widely spreading local anti- 
Western and anti-NATO propaganda and conspiracy theories, Velkov was also involved 
in information operations in the 2016 U.S. presidential elections.©84 Velkov was the author 


of “the *PizzaGate’ conspiracy, alleging that Hillary Clinton had run a child sex ring in a 
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pizza shop.”685 Velkov had direct contacts with the coordinator of influence agents, 
oligarch Konstantin Malofeev, and RISS director Leonid Reshetnikov, both identified in 


the Montenegrin case study.686 


Regarding the rest of the influencing, as it did in Estonia and Montenegro, Russia 
established a so-called central body in North Macedonia to coordinate and direct broader 
influence in the target country. This central body in North Macedonia appears to be the 
Russian Cultural Center in the capital, Skopje.687 In addition to this central body, nearly 
30 Russian-Macedonian “twinning associations” have been established in Macedonia, and 
Orthodox churches have been built across the country. In combination, these influencing 
organizations are “pushing an idea of ‘pan—Slavic’ identity and shared Orthodox Christian 


faith [in North Macedonia].’’688 


C. CONCLUSION 


Based on the framing provided by Chapter II and the studied cases, it can be said 
that Russian NTW campaigns require that there be no cohesive society in the target 
country. Contradictions and a divided society in the target country are the basis on which 
Russia can build an NTW campaign and choose the elements of NTW, non-state actors, to 
carry out the campaign. Thus, the most crucial aspect of launching and conducting an NTW 
campaign is the psychological influencing and so-called unbalancing of the target country’s 
society and government. It is easier to run an NTW campaign where the public is already 
not homogeneous. In such environments, Russia seeks to preserve and amplify the target 
country’s social contradictions. The author assesses that Russia’s goal is not necessarily to 
make the society or government of the target country pro-Russian; the goal would also be 
fulfilled if the target groups’ mentality coincides with Russia’s interests, like the growing 


distrust of democracy, Western organizations, and Western unity. 
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The psychological influencing of opponents, which includes propaganda and 
information operations in the media and cybersphere, as well as influence agents among 
the society of the target country, is the basis of the NTW concept. Russia primarily focuses 
on influencing in its preparations for an NTW because a successful influence campaign 
lays the foundation for creating and using the remaining NTW elements, for example, 
violent actors, once the campaign starts to develop. Russia uses pro-Russian auxiliary 
(ideological), proxy (overlapping objectives), and affiliate (acting for profit) violent non- 
state actors to hide its involvement in the conflict or to ostensibly distance itself from the 


struggle. 


Nevertheless, it is challenging to distinguish which actors act in favor of Russia for 
what motives. The boundaries between the motives of violent non-state actors exploited by 
Russia are blurred and may change over time or in different situations. For example, the 
ideological pro-Kremlin Nashi members’ primary motivation to support the local pro- 
Kremlin Night Watch in Estonia in the Bronze Soldier case was the financial bonus 
received for it. According to this example, by definition, auxiliary actors acted in this 
specific situation instead of as proxies or even as affiliates. As a reminder, auxiliaries are 
non-state actors who are ideologically motivated, proxies act primarily for their own 
interest and benefit that aligns with Russian interests, and affiliates operate mainly for 
profit. Therefore, it is probable that Russia is not paying particular attention to differentiate 
these subtypes of non-state actors, except that Russia’s special services know what tools or 
techniques they can use to activate and exploit the different subtypes and apply these tools 


and techniques to different situations accordingly. 


Organized crime cannot be categorized precisely into a particular violent non-state 
actor’s subtype, and Russia seems to exploit organized crime throughout its NTW concept. 
As described in Chapter IT, Russian special services use organized crime to carry out a wide 
range of assignments abroad.89 It resembles a model that involves a combination of three 


subtypes of violent non-state actors—auxiliary, proxy, and affiliate. Russia’s special 
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services use organized crime abroad, from influencing and cyber-attacks to armed attacks 


in a coup attempt, and to support, amplify, and mediate other non-state actors’ activities. 


Even though there was almost a ten-year gap between Estonia and Montenegro’s 
events, a similar pattern emerged from the study of how Russia is likely to prepare for an 
NTW campaign and use non-state actors against the target country. The possible pattern 
found in the case studies, the non-state actors’ links with Russia and the cooperation 
between non-state actors, are explained in this chapter’s following sections. The sections 
are based on Russia’s objectives and separate actors. At the end of these sections, the author 
has compiled a scheme that visualizes what has been described and helps the reader 


understand Russia’s use of non-state actors and their cooperation more easily. 
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